CVE-2026-31942: LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body to overwrite any other user's API keys (e.g., OpenAI, Anthropic, Azure). This allows an attacker to replace a victim's API key configuration, potentially routing the victim's conversations through attacker-controlled keys or denying service by providing invalid keys. This is patched in version 0.8.3-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreChatto a version that resolves this vulnerability.Fixed in 0.8.3-rc1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31942?
CVE-2026-31942 has a high severity score of 7.1.
How do I fix CVE-2026-31942?
To fix CVE-2026-31942, ensure you update LibreChat to version 0.7.7 or later, which addresses the insecure direct object reference issue.
What is the impact of CVE-2026-31942?
CVE-2026-31942 allows any authenticated user to overwrite other users' API keys, potentially leading to unauthorized access and data manipulation.
Which versions of LibreChat are affected by CVE-2026-31942?
LibreChat versions up to and including 0.7.6 are affected by CVE-2026-31942.
What does IDOR mean in the context of CVE-2026-31942?
In the context of CVE-2026-31942, IDOR stands for Insecure Direct Object Reference, which allows attackers to access or modify objects they shouldn't have permissions for.