LibreChat versions 0.8.2-rc1 through 0.8.3-rc1 allow user‑created MCP servers to inject arbitrary HTTP headers that are processed on the server side with credential placeholder substitution. An attacker can embed the placeholder {{LIBRECHAT_OPENID_ACCESS_TOKEN}} into a header so that any user who invokes a tool on that MCP server has their OAuth token automatically captured and sent to the attacker. The primary impact is the exfiltration of user authentication tokens, which can be used to impersonate the user or gain unauthorized access to services.

The affected product is LibreChat, a ChatGPT clone developed by danny‑avila. Vulnerable releases range from 0.8.2‑rc1 to 0.8.3‑rc1 inclusive. The issue was fixed in 0.8.3‑rc2 and later releases, so administrators should upgrade to at least that version to eliminate the risk.

The CVSS score of 6.8 indicates moderate severity, but the EPSS score is below 1 %, showing a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious MCP server and for a victim to execute a tool that contacts that server, so attack feasibility is contingent on user interaction with the compromised server. Given these conditions, the overall risk is moderate but exploitable in environments where user‑created MCP servers are routinely used.