langchat vulnerabilities

Products

• langchat/langchat 1

Latest langchat CVEs

Newest publication first

1. CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers

   Published 2026-10-16

   Critical·CVSS 9.3

   LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.