CVE-2026-54030: LibreChat MCP OAuth Token Validation Bypass

Technical summary

The vulnerability stems from missing validation of the 'resource' parameter in OAuth Protected Resource metadata as defined in RFC 9728. When LibreChat receives an OAuth token response from an MCP server connection, it does not verify that the resource parameter—which indicates which server the token is intended for—matches the legitimate MCP server URL the user configured. This allows an attacker controlling a malicious MCP server to return a crafted OAuth response with a resource parameter pointing to a different service, causing LibreChat to accept tokens destined for the legitimate server and store or use them for the attacker's server. The root cause is inadequate input validation during the OAuth handshake for MCP integrations, classified as Incorrect Validation of Specified Quantity in Input (CWE-346).

Business impact

If exploited, this vulnerability could lead to unauthorized access to user accounts on integrated AI platforms and services. An attacker stealing an access token gains the same permissions as the victim, potentially allowing them to read, modify, or delete data within those services, send messages on behalf of the user, or perform other authenticated actions. For organizations deploying LibreChat as an internal tool connected to enterprise AI services, token theft could compromise sensitive data and facilitate lateral movement. The attack requires user interaction (visiting a malicious MCP server), which limits the blast radius but remains a credible threat in environments where users are encouraged to extend LibreChat's capabilities through custom MCP integrations.

Affected systems

LibreChat versions prior to 0.8.5 are affected. The vulnerability applies to any deployment where MCP server connections are enabled and users have the ability to add or be directed to MCP servers. Self-hosted instances are at highest risk, particularly those in environments where MCP server discovery or community-shared server listings are in use. The issue does not affect LibreChat instances that do not use MCP integrations or have disabled OAuth authentication for MCP providers.

Exploitability

Exploitation requires user interaction—specifically, a user must be tricked into connecting to a malicious MCP server or be directed to one via social engineering. The attacker must control an MCP server infrastructure to serve malicious OAuth responses. Once a user is compromised, the token theft occurs automatically during the OAuth handshake. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects the network-accessible nature of the attack, the high complexity (requiring an attacker-controlled server), lack of privilege requirement, and mandatory user interaction. This is not a trivial exploit requiring deep technical knowledge of LibreChat internals, but it is well within reach of a moderately skilled adversary.

Remediation

Upgrade LibreChat to version 0.8.5 or later, which implements proper validation of the resource parameter against the configured MCP server URL. No workarounds are available for earlier versions; patching is the only reliable mitigation. Organizations should inventory their LibreChat deployments and prioritize upgrades in environments where MCP integrations are actively used. After patching, consider reviewing MCP server configurations to ensure only trusted servers are whitelisted.

Patch guidance

Apply the 0.8.5 release or any subsequent version. The fix involves server-side validation in the OAuth token handling logic and does not require configuration changes. Before upgrading, test in a non-production environment to ensure compatibility with any custom MCP server integrations. After upgrading, users should be informed that they may need to re-authenticate to MCP servers, and any suspicious token usage in integrated services should be investigated.

Detection guidance

Monitor OAuth token requests and responses in LibreChat logs for resource parameter mismatches between the configured MCP server URL and the value returned in OAuth metadata. Look for user accounts suddenly accessing multiple AI provider services from new geographic locations or with unusual token lifetimes. Inspect MCP server connection logs for failed token validation or rejection events (if available in the patched version). In network monitoring, flag unexpected connections from LibreChat instances to unknown or unauthorized MCP servers, particularly those serving OAuth endpoints. Security teams should review which MCP servers users have connected to and verify their legitimacy.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.0), the potential for account takeover across integrated services, and the relative ease of deploying an attack. While user interaction is required, the barrier to exploitation is not prohibitively high—attackers can use phishing or social engineering to direct users to malicious MCP servers. Organizations with active LibreChat deployments handling sensitive data or connected to critical AI services should patch urgently. The lack of KEV status does not diminish the risk; it reflects the vulnerability's recency rather than its severity.

Risk score, explained

The CVSS 8.0 (HIGH) score reflects the combination of high confidentiality and integrity impact (token theft and impersonation), network accessibility, and user interaction requirement. Complexity is rated as high because an attacker must set up a functioning MCP server and social engineer the user, but these are achievable steps. The scope is changed (C), as compromised tokens can be leveraged to access services outside LibreChat itself. The absence of availability impact (no denial of service) prevents a critical rating. For organizations with strict data handling requirements or multi-tenant deployments, the effective risk may be higher due to downstream impact on integrated services.

Frequently asked questions