CVE Intelligence

LangChat vulnerabilities

🔔 Create alert RSS

Published CVEs affecting LangChat products: 1 record(s), with severity, exploitation and fixes.

Langchat 1

Exploited only (KEV) →

CVE-2026-111704 Critical · 9.8 CWE-306 Oct 16, 2026
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.