CVE-2026-31950: LibreChat Auth Bypass Vulnerability

CVE-2026-31950 Overview

CVE-2026-31950 is an Insecure Direct Object Reference (IDOR) vulnerability affecting LibreChat, an open-source ChatGPT clone with additional features. The vulnerability exists in the Server-Sent Events (SSE) streaming endpoint /api/agents/chat/stream/:streamId, which fails to verify that the requesting user owns the stream they are attempting to access. This authorization bypass allows any authenticated user who obtains or guesses a valid stream ID to subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations.

Critical Impact

Authenticated attackers can intercept and read other users' private chat conversations, AI responses, and tool invocations in real-time by exploiting missing authorization checks on streaming endpoints.

Affected Products

• LibreChat version 0.8.2-rc2
• LibreChat version 0.8.2-rc3

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-31950 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-31950

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key). The root issue lies in the SSE streaming endpoint's failure to implement proper ownership verification. When a user initiates a chat session with LibreChat, a unique stream ID is generated to facilitate real-time communication between the client and server. However, the endpoint responsible for serving this stream does not validate whether the authenticated user making the request is the legitimate owner of that stream.

The attack requires network access and valid authentication credentials, though the complexity is elevated because the attacker must obtain or successfully guess a valid stream ID. If stream IDs follow predictable patterns or can be enumerated, the attack becomes significantly more feasible. Upon successful exploitation, the attacker gains unauthorized read access to highly sensitive data including private conversations, AI-generated responses, and any tool invocations occurring within the victim's chat session.

Root Cause

The vulnerability stems from a missing authorization check in the streaming endpoint handler. The endpoint at /api/agents/chat/stream/:streamId accepts the stream ID as a URL parameter and establishes an SSE connection without verifying that the requesting user's session corresponds to the stream's owner. This represents a classic Insecure Direct Object Reference pattern where a user-controlled identifier (the stream ID) is used to access resources without proper access control validation.

Attack Vector

The attack is conducted over the network and requires the attacker to have valid authentication credentials for the LibreChat instance. The attacker must then obtain a valid stream ID belonging to another user, either through enumeration (if IDs are predictable), interception, or other means. Once a valid stream ID is acquired, the attacker can subscribe to the SSE endpoint and receive all real-time data transmitted through that stream.

The vulnerability mechanism involves sending an authenticated request to the streaming endpoint with another user's stream ID. Without proper ownership validation, the server establishes the SSE connection and begins transmitting the victim's chat data to the attacker in real-time. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-31950

Indicators of Compromise

• Anomalous SSE connection patterns where a single user session connects to multiple stream IDs
• Authentication logs showing users accessing stream endpoints for conversations they did not initiate
• Unusual spikes in /api/agents/chat/stream/:streamId endpoint access from individual user accounts

Detection Strategies

• Implement logging that correlates stream ID ownership with the authenticated user making requests to the streaming endpoint
• Monitor for brute-force or enumeration attempts against stream IDs by tracking rapid sequential requests to different stream endpoints
• Deploy web application firewall (WAF) rules to detect and alert on abnormal streaming endpoint access patterns

Monitoring Recommendations

• Enable detailed access logging for all SSE streaming endpoints with user context
• Configure alerting for users accessing stream IDs outside their normal session activity
• Review authentication and authorization logs for the /api/agents/chat/stream/ path regularly

How to Mitigate CVE-2026-31950

Immediate Actions Required

• Upgrade LibreChat to version 0.8.2 or later, which contains the security patch
• If immediate upgrade is not possible, consider temporarily disabling the affected streaming endpoint
• Audit access logs to identify any potential exploitation that may have occurred

Patch Information

LibreChat version 0.8.2 addresses this vulnerability by implementing proper authorization checks on the SSE streaming endpoint. The patch ensures that the server validates stream ownership before establishing connections, preventing unauthorized users from accessing streams they do not own. For complete details about the fix, consult the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict access to the streaming endpoint if patching is delayed
• Add a reverse proxy rule to validate stream ownership before requests reach the application
• Consider implementing rate limiting on the streaming endpoint to impede enumeration attacks

# Example nginx rate limiting for streaming endpoint
limit_req_zone $binary_remote_addr zone=stream_limit:10m rate=10r/s;

location /api/agents/chat/stream/ {
    limit_req zone=stream_limit burst=5 nodelay;
    proxy_pass http://librechat_backend;
}