A flaw in the SSE streaming endpoint permits an authenticated user who has or can guess a valid stream identifier to subscribe without ownership checks, exposing another user's real-time chat content, including messages, AI output, and tool calls. This results in confidentiality compromise and corresponds to a CWE‑284 vulnerability. The attack requires only valid authentication credentials and a stream ID, no additional privileges.

LibreChat released by danny-avila is affected in versions 0.8.2‑rc2 through 0.8.2‑rc3, which lack stream ownership validation. Version 0.8.2 includes the fix.

The CVSS score is 5.3, indicating moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with legitimate credentials who obtains or guesses a stream ID, enabling them to read another user’s private conversations. No public exploits are known, but the vulnerability can be exercised in any environment where the impacted LibreChat instance is exposed. Prompt remediation is advised to prevent potential data leakage.