LibreChat is a ChatGPT clone with additional features.
LibreChat lets users add their own MCP tool servers, including custom HTTP headers. A bug let those headers contain placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} that got silently filled in with the real access token, so anyone who tricked a user into calling their malicious MCP server got a copy of that user's OAuth credentials.
How the attack works
An attacker creates a malicious MCP server definition and adds a custom HTTP header containing a credential placeholder such as {{LIBRECHAT_OPENID_ACCESS_TOKEN}}. They get a victim (or trick the victim's agent) into registering or calling this MCP server from within LibreChat. When the victim's session invokes a tool on that server, LibreChat substitutes the real OAuth access token into the header before sending the request. The token is transmitted to the attacker's server, giving them a valid credential they can use to impersonate the victim.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f3e04913-256a-4a9f-a6c1-f3f27fd1a33a
- Severity
- High
- CVEs
- CVE-2026-31951
Why it matters
An attacker can obtain a victim's live OAuth access token, allowing account impersonation and access to whatever resources that token permits, without needing to phish credentials directly.
What you can do
- →Upgrade LibreChat to version 0.8.3-rc2 or later, which fixes this substitution behavior.
- →Review all user-added MCP server definitions for custom headers referencing credential placeholders like LIBRECHAT_OPENID_ACCESS_TOKEN.
- →Restrict who can register or edit MCP server configurations, especially in shared or multi-tenant LibreChat deployments.
- →Audit recent OAuth token usage and rotate tokens if a malicious MCP server registration is found.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.