LibreChat versions prior to 0.8.5 are susceptible to token theft via an improper OAuth resource validation flaw during MCP server interaction.

The vulnerability exists in the MCP (Model Context Protocol) OAuth implementation. It occurs because the system fails to validate that the resource parameter from the OAuth Protected Resource metadata matches the configured MCP server URL, allowing an attacker to intercept access tokens.

With a CVSS score of 8.0, this vulnerability carries a high risk of unauthorized access to connected AI services and sensitive data. If an attacker successfully forces the application to interact with a malicious MCP server, they can exfiltrate OAuth tokens, leading to full account takeover or unauthorized data processing within the AI interface.

Immediate Action: Update LibreChat to version 0.8.5 or later, which includes the necessary validation logic for OAuth resources.

Proactive Monitoring: Audit existing MCP server configurations for unauthorized or unrecognized endpoints that may have been added to the AI interface.

Compensating Controls: Limit access to external MCP servers to only those explicitly vetted and trusted by the organization.

Public Exploit Available: false

Given the potential for complete token theft and subsequent unauthorized access to AI resources, organizations should treat this update with high urgency. Patching to version 0.8.5 is the only effective way to prevent malicious MCP servers from exploiting this authentication gap.