CVE-2026-31942
Analyzed Analyzed - Analysis Complete
IDOR in LibreChat API Keys Management

Publication date: 2026-06-02

Last updated on: 2026-06-04

Assigner: GitHub, Inc.

Description
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body to overwrite any other user's API keys (e.g., OpenAI, Anthropic, Azure). This allows an attacker to replace a victim's API key configuration, potentially routing the victim's conversations through attacker-controlled keys or denying service by providing invalid keys. This is patched in version 0.8.3-rc1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-02
Last Modified
2026-06-04
Generated
2026-06-24
AI Q&A
2026-06-03
EPSS Evaluated
2026-06-22
NVD
CVE-2026-31942
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
librechat librechat to 0.8.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) found in LibreChat versions up to and including 0.7.6, specifically in the API keys management endpoint (PUT /api/keys).

Due to the way the JavaScript object spread operator is used after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body. This allows them to overwrite another user's API keys, such as those for OpenAI, Anthropic, or Azure.

Essentially, an attacker can replace a victim's API key configuration, which could route the victim's conversations through attacker-controlled keys or cause denial of service by providing invalid keys.

This vulnerability was fixed in version 0.8.3-rc1.

Impact Analysis

This vulnerability can have significant impacts including unauthorized modification of your API key configurations.

  • An attacker could replace your API keys with their own, potentially routing your conversations through attacker-controlled keys.
  • This could lead to interception or manipulation of your data or conversations.
  • Alternatively, an attacker could provide invalid keys, causing denial of service by preventing you from using the API.
Mitigation Strategies

To mitigate this vulnerability, upgrade LibreChat to version 0.8.3-rc1 or later, where the issue has been patched.

Additionally, restrict access to the API keys management endpoint (PUT /api/keys) to trusted users only, and monitor for any unauthorized changes to API key configurations.

Compliance Impact

The vulnerability allows an authenticated user to overwrite other users' API keys, potentially leading to unauthorized access or denial of service by manipulating API key configurations.

Such unauthorized access or manipulation of user data could impact compliance with standards and regulations like GDPR or HIPAA, which require protection of user data and prevention of unauthorized access.

However, the provided information does not explicitly describe the direct effects on compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31942. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart