{"data":{"id":"e6835d8a-86c9-4cbf-99d0-45d244aef572","title":"CVE-2026-31942: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an…","summary":"CVE-2026-31942 affects LibreChat in versions up to and including 0.7.6. An Insecure Direct Object Reference flaw in the PUT /api/keys endpoint lets any authenticated user add a userId parameter to the request body, which overwrites another user's API keys (such as OpenAI, Anthropic or Azure). An attacker could route a victim's conversations through attacker-controlled keys or cause denial of service with invalid keys.","solution":"Patched in version 0.8.3-rc1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31942","publishedAt":"2026-06-02T23:16:35.687Z","cveId":"CVE-2026-31942","cweIds":["CWE-862"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Anthropic"],"affectedVendorsRaw":["LibreChat","OpenAI","Anthropic","Azure OpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LibreChat IDOR in API keys endpoint lets users overwrite other users' keys","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00206,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:44.853Z","patchAvailable":null,"disclosureDate":"2026-06-02T23:16:35.687Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}