danny-avila LibreChat up to 0.7.6/0.8.2 API Keys Management Endpoint /api/keys userId authorization

Summaryinfo

A vulnerability was found in danny-avila LibreChat up to 0.7.6/0.8.2. It has been classified as problematic. Affected is an unknown function of the file /api/keys of the component API Keys Management Endpoint. Performing a manipulation of the argument userId results in authorization. This vulnerability is reported as CVE-2026-31942. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in danny-avila LibreChat up to 0.7.6/0.8.2. This affects an unknown code block of the file /api/keys of the component API Keys Management Endpoint. The manipulation of the argument userId with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. The summary by CVE is:

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request body to overwrite any other user's API keys (e.g., OpenAI, Anthropic, Azure). This allows an attacker to replace a victim's API key configuration, potentially routing the victim's conversations through attacker-controlled keys or denying service by providing invalid keys. This is patched in version 0.8.3-rc1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-31942 since 03/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 0.8.3-rc1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34044). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Chat Software

Vendor

• danny-avila

Name

• LibreChat

Version

• 0.7.0
• 0.7.1
• 0.7.2
• 0.7.3
• 0.7.4
• 0.7.5
• 0.7.6
• 0.8.0
• 0.8.1
• 0.8.2

Website

• Product: https://github.com/danny-avila/LibreChat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion