# LibreChat is a ChatGPT clone with additional features.

- **Severity:** High
- **Signature ID:** `f3e04913-256a-4a9f-a6c1-f3f27fd1a33a`
- **CVEs:** CVE-2026-31951
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

LibreChat lets users add their own MCP tool servers, including custom HTTP headers. A bug let those headers contain placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} that got silently filled in with the real access token, so anyone who tricked a user into calling their malicious MCP server got a copy of that user's OAuth credentials.

## How the attack works

An attacker creates a malicious MCP server definition and adds a custom HTTP header containing a credential placeholder such as {{LIBRECHAT_OPENID_ACCESS_TOKEN}}. They get a victim (or trick the victim's agent) into registering or calling this MCP server from within LibreChat. When the victim's session invokes a tool on that server, LibreChat substitutes the real OAuth access token into the header before sending the request. The token is transmitted to the attacker's server, giving them a valid credential they can use to impersonate the victim.

## Why it matters

An attacker can obtain a victim's live OAuth access token, allowing account impersonation and access to whatever resources that token permits, without needing to phish credentials directly.

## What you can do

- Upgrade LibreChat to version 0.8.3-rc2 or later, which fixes this substitution behavior.
- Review all user-added MCP server definitions for custom headers referencing credential placeholders like LIBRECHAT_OPENID_ACCESS_TOKEN.
- Restrict who can register or edit MCP server configurations, especially in shared or multi-tenant LibreChat deployments.
- Audit recent OAuth token usage and rotate tokens if a malicious MCP server registration is found.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00566
- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-pmw7-gqwj-f954
- https://nvd.nist.gov/vuln/detail/CVE-2026-31951

---
Source: https://www.netzilo.com/threats/atr-librechat-is-a-chatgpt-clone-with-additional-features