In LibreChat versions 0.8.2-rc1 to 0.8.3-rc1, the Model Context Protocol (MCP) implementation allows user-created servers to include arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can exploit this by creating a malicious MCP server with headers containing placeholders such as {{LIBRECHAT_OPENID_ACCESS_TOKEN}}, causing the victim's OAuth tokens to be sent to the attacker. This results in exposure of sensitive authentication tokens to unauthorized actors. The vulnerability is tracked as CVE-2026-31951 with a CVSS 3.1 base score of 6.8 (medium severity). The issue is resolved in LibreChat version 0.8.3-rc2.

The vulnerability allows unauthorized disclosure of OAuth access tokens from users interacting with malicious MCP servers, potentially enabling unauthorized access to user accounts or services relying on those tokens. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Users should upgrade LibreChat to version 0.8.3-rc2 or later, where this vulnerability is fixed. Since this is a client-side application vulnerability and not a cloud service, remediation requires applying the official patch by updating the software. Patch status is confirmed fixed in version 0.8.3-rc2.