CVE-2025-41258: Librechat

High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days.

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.

Affected products

• Librechat Librechat: version 0.8.1 only

Published 2026-03-18. Last modified 2026-06-17.