Executive brief
LibreChat, an open-source interface for multiple AI providers, contains a security flaw that allows any logged-in user to modify the API keys of other users. By overwriting these keys, an attacker can disrupt a victim's service or potentially redirect their AI conversations through an account controlled by the attacker. This could lead to the exposure of sensitive conversation data to the attacker via their AI provider's logs.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the 'PUT /api/keys' endpoint due to improper use of the JavaScript object spread operator. In 'api/server/routes/keys.js', the application sets the 'userId' from the authenticated session but then applies '...req.body', which allows an attacker to provide a 'userId' in the request body that overrides the legitimate one. An authenticated attacker can exploit this to call 'updateUserKey' for any arbitrary user ID, replacing their configured API keys (e.g., OpenAI, Anthropic) with attacker-supplied values. This allows for service disruption or conversation interception via the attacker's own AI provider accounts. The issue is fixed in version 0.8.3-rc1 by explicitly destructuring only allowed fields from the request body.
Affected products
- LibreChat LibreChat <= 0.7.6
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
- 2026-06-02: patched: Patched in 0.8.3-rc1