CVE Intelligence
Analysis AI-assisted

CVE-2026-54030: LibreChat MCP OAuth Token Theft via Unvalidated Resource Parameter

LibreChat before 0.8.5 does not check that the resource parameter in OAuth Protected Resource metadata matches the configured MCP server URL. A malicious MCP server could therefore receive access tokens meant for a legitimate server. The description states the issue is fixed in 0.8.5.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

LibreChat is a multi-provider AI chat application. According to the record, its MCP OAuth flow does not check that the resource value from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL. The record classifies the weakness as CWE-346.

Impact

  • A malicious MCP server may be able to obtain access tokens intended for a legitimate server.
  • NVD scores the issue 9.3 (CVSS 3.1, critical) and GitHub scores it 8. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N indicates high confidentiality and integrity impact, with user interaction required.

Affected products and versions

  • Product: LibreChat (listed in the record as Librechat Librechat).
  • The record lists versions up to and including 0.8.4, and version 0.8.5-rc1, as affected.
  • The description states the fix is in 0.8.5. The structured fixes field is empty, so the fixed build is not listed in structured data.

Exploitation status

  • The CISA KEV catalog does not list this CVE.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • One reference is tagged as exploit-related. Its content was not available for this analysis, so the nature of that tag remains unknown.

Remediation and mitigation

  • Upgrade LibreChat to 0.8.5, the version the description identifies as fixed, and confirm the release candidate status with the vendor.
  • Review which MCP servers are configured and remove any that are untrusted, because the described attack depends on a malicious MCP server receiving tokens.
  • Consider rotating OAuth tokens issued to MCP integrations if a server was connected while a vulnerable version ran and its trust is in doubt.

Detection guidance

  • Inventory LibreChat deployments and their version strings to identify instances at or below 0.8.4 or running 0.8.5-rc1.
  • Audit MCP server configurations and the protected resource metadata they publish.
  • Monitor identity provider logs for unexpected token use from MCP integrations. This is general guidance, not a verified indicator of compromise.

Limitations of the available information

  • The record does not include a CWE name, EPSS data, or a structured list of fixed builds.
  • The affected range (up to 0.8.4, plus 0.8.5-rc1) and the fix statement (0.8.5) do not fully align, so the status of release candidates should be confirmed with the vendor advisory.
  • The two CVSS scores differ between sources, and the record does not describe prerequisites beyond the vector.

Frequently asked questions

Which LibreChat version fixes this issue?

The record's description states that the issue is fixed in 0.8.5. The structured fixes field is empty, so the vendor advisory should be checked for the exact build details.

Is this vulnerability known to be exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.