VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 27, 2026· Updated Jun 17, 2026

CVE-2026-31950

CVE-2026-31950

Description

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint /api/agents/chat/stream/:streamId does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations. Version 0.8.2 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Librechat/Librechat4 versions
    cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:librechat:librechat:0.8.2:rc2:*:*:*:*:*:*
    • cpe:2.3:a:librechat:librechat:0.8.2:rc3:*:*:*:*:*:*
    • (no CPE)range: 0.8.2-rc2 - 0.8.2-rc3
    • (no CPE)range: >= 0.8.2-rc2, < 0.8.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.