Suggestions search

Untriaged

Filter by:

With package: librechat

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2025-41258

8.0 HIGH

CVSS version: 3.1
Attack vector (AV): ADJACENT_NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 4 days ago

LibreChat RAG API Authentication Bypass

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

References

https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_… third-party-advisory
https://github.com/danny-avila/LibreChat product

Affected products

LibreChat

==0.8.1-rc2

Matching in nixpkgs

pkgs.librechat

Open-source app for all your AI conversations, fully customizable and compatible with any AI provider

nixos-unstable 0.8.0
- nixpkgs-unstable 0.8.0
- nixos-unstable-small 0.8.0
nixos-25.11 0.8.0
- nixos-25.11-small 0.8.0
- nixpkgs-25.11-darwin 0.8.0

Package maintainers

@niklaskorz Niklas Korz <nixpkgs@korz.dev>

Permalink CVE-2026-33265

6.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW