Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:56:58 +0000 CVE-2026-54030 — LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow https://cve.radiocsirt.org/vuln/cve-2026-54030 <p><strong>Affected:</strong> danny-avila LibreChat</p> <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat&#39;s MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.</p> <p><strong>Affected:</strong> danny-avila LibreChat</p> <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat&#39;s MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-54030