LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 18, 2026 · NIST NVD

   Detected

   LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

2. Jun 17, 2026 · NIST NVD

   Updated

   LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

Affected

• cpe librechat/librechat0.8.1

Sources

• CVE.orgVulnerability recordCVE-2025-41258

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-41258

  LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

  nvd.nist.gov

References

• Product · github.com
• Exploit · github.com