LibreChat versions 0.8.2‑rc1 to 0.8.3‑rc1 allow user‑created MCP servers to inject arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can craft a malicious MCP server with a header containing the placeholder {{LIBRECHAT_OPENID_ACCESS_TOKEN}}, which is replaced with the victim’s OAuth token when a client calls a tool on that server. The stolen token can be used to impersonate the user’s authenticated session, granting the attacker full account access and the ability to impersonate the user for any action the user is authorized to perform.

This flaw affects LibreChat maintained by danny‑avila, specifically versions 0.8.2‑rc1 through 0.8.3‑rc1. Version 0.8.3‑rc2 contains a fix that removes the vulnerable header injection behaviour. No other versions or vendors are known to be impacted.

The CVSS score is 6.8, indicating a moderate severity vulnerability. No EPSS data is available, and the issue is not included in the CISA KEV catalog. The attack requires the victim to engage with a crafted MCP server that supplies the malicious header; the victim’s client will replace the placeholder and forward the token to the attacker. Once exfiltrated, the attacker can readily abuse the token to access protected resources. Because the exploit path is relatively simple and does not require additional conditions, the risk is significant for environments where users interact with untrusted MCP servers.