CVE-2026-31942
IDOR in LibreChat API Keys Management
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| librechat | librechat | to 0.7.6 (inc) |
| librechat | librechat | 0.8.3-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) found in LibreChat versions up to and including 0.7.6, specifically in the API keys management endpoint (PUT /api/keys).
Due to the way the JavaScript object spread operator is used after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body. This allows them to overwrite another user's API keys, such as those for OpenAI, Anthropic, or Azure.
Essentially, an attacker can replace a victim's API key configuration, which could route the victim's conversations through attacker-controlled keys or cause denial of service by providing invalid keys.
This vulnerability was fixed in version 0.8.3-rc1.
How can this vulnerability impact me? :
This vulnerability can have significant impacts including unauthorized modification of your API key configurations.
- An attacker could replace your API keys with their own, potentially routing your conversations through attacker-controlled keys.
- This could lead to interception or manipulation of your data or conversations.
- Alternatively, an attacker could provide invalid keys, causing denial of service by preventing you from using the API.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade LibreChat to version 0.8.3-rc1 or later, where the issue has been patched.
Additionally, restrict access to the API keys management endpoint (PUT /api/keys) to trusted users only, and monitor for any unauthorized changes to API key configurations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated user to overwrite other users' API keys, potentially leading to unauthorized access or denial of service by manipulating API key configurations.
Such unauthorized access or manipulation of user data could impact compliance with standards and regulations like GDPR or HIPAA, which require protection of user data and prevention of unauthorized access.
However, the provided information does not explicitly describe the direct effects on compliance with these regulations.