Is CVE-2026-54030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54030 being exploited in the wild.

How severe is CVE-2026-54030?

High severity, with a CVSS score of 8, published 25 June 2026.

Is there a fix for CVE-2026-54030?

A patch was published on 2026-06-25: Fix released in version 0.8.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54030 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54030?

Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54030: LibreChat token theft via missing OAuth resource validation in MCP

CVE-2026-54030 · Severity: high · CVSS 8 · Published 2026-06-25

LibreChat is an open-source interface for interacting with various AI models. A security flaw in how it handles connections to third-party AI services (MCP servers) allows a malicious server to trick the application into sending sensitive login tokens to the wrong destination. If a user connects to a compromised or malicious server, an attacker could steal their access tokens and impersonate them on legitimate AI platforms, potentially leading to unauthorized data access or account takeover.

Technologies: LibreChat. Vendors: LibreChat.

Quick answers

Is CVE-2026-54030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54030 being exploited in the wild.
How severe is CVE-2026-54030?: High severity, with a CVSS score of 8, published 25 June 2026.
Which products and versions are affected?: LibreChat < 0.8.5.
Is there a fix for CVE-2026-54030?: A patch was published on 2026-06-25: Fix released in version 0.8.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54030 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54030?: Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in LibreChat's Model Context Protocol (MCP) OAuth implementation due to a failure to adhere to RFC 9728 validation requirements. Specifically, the application does not verify that the 'resource' parameter returned in OAuth Protected Resource metadata matches the configured MCP server URL. An attacker can host a malicious MCP server that, when connected to by a victim, provides metadata pointing to a legitimate resource. Because LibreChat fails to validate this mismatch in 'packages/api/src/mcp/oauth/handler.ts', it initiates an OAuth flow that results in a valid access token for a legitimate service being sent to the attacker's server. This allows for full impersonation of the victim on the legitimate service. The issue is fixed in version 0.8.5.

Affected products

danny-avila LibreChat < 0.8.5

Timeline

2026-06-02: advisory: GitHub advisory published by vendor
2026-06-25: disclosed: CVE published to NVD
2026-06-25: patched: Fix released in version 0.8.5

References

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gvpj-vm2f-2m23

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.