CVE-2026-31944: LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redirect URL is logged in or that the logged-in user matches the initiator. An attacker can send the authorization URL to a victim; when the victim completes the flow, the victim’s OAuth tokens are stored on the attacker’s LibreChat account, enabling account takeover of the victim’s MCP-linked services (e.g. Atlassian, Outlook). This vulnerability is fixed in 0.8.3-rc1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31944?
CVE-2026-31944 is considered a high-severity vulnerability due to its potential for token theft and unauthorized access.
How do I fix CVE-2026-31944?
To fix CVE-2026-31944, ensure that your version of LibreChat is updated to a version beyond 0.8.2-rc3, and implement session validation on the OAuth callback.
What are the potential consequences of CVE-2026-31944?
The consequences of CVE-2026-31944 include unauthorized access to user sessions and the potential for malicious actors to steal authentication tokens.
Which versions of LibreChat are affected by CVE-2026-31944?
CVE-2026-31944 affects LibreChat versions from 0.8.2 up to 0.8.2-rc3.
Is there a patch available for CVE-2026-31944?
Yes, a patch is available by upgrading LibreChat to a version that is above 0.8.2-rc3.