Back to Database
Status published
High
CVE-2025-41258
LibreChat RAG API Authentication Bypass
Vulnerability Description
LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41258
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Lisa Gnedt (SBA Research)
- Michael Koppmann (SBA Research)
References
More from danny-avila
View All →CVE-2025-8850
Insecure API Design in danny-avila/librechat
Low
3.1
CVE-2025-8849
Denial of Service in danny-avila/librechat
Medium
5.4
CVE-2025-8848
HTML Injection in Accept-Language Header in danny-avila/librechat
Medium
4.8
CVE-2025-7106
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
Medium
5.3
CVE-2025-7105
Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
Medium
5.7
Affected Vendor
danny-avila
View all reports →Affected Software
LibreChat
Vulnerable Versions:
0.8.1-rc2
Timeline
Official Publish:
March 18th, 2026
Last Modified:
March 18th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H