CVE-2026-33265

MEDIUM

LibreChat 0.8.1-rc2 - Auth Bypass

Title source: llm
STIX 2.1

Description

In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.

References (2)

Scores

CVSS v3 6.3
EPSS 0.0008
EPSS Percentile 24.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-669
Status published
Products (2)
librechat/librechat 0.8.1 rc2
LibreChat/LibreChat 0.8.1-rc2
Published Mar 18, 2026
Tracked Since Mar 18, 2026