LangChat Langchat vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting LangChat Langchat: 1 record(s), with affected versions and fixes.

CVE-2026-111704 Critical · 9.8 CWE-306 Oct 16, 2026

LangChat through commit 2a6285a Missing Authentication on REST API Controllers

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.