{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alangchatlangchat/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:langchat:langchat:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111704"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LangChat (\u003c= 2a6285a)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","cve","api-security"],"_cs_type":"advisory","_cs_vendors":["LangChat"],"content_html":"\u003cp\u003eLangChat, an LLM-focused application, contains a critical authentication bypass vulnerability (CVE-2026-111704) affecting all versions up to commit 2a6285a. The vulnerability stems from the absence of a required Sa-Token interceptor, which is responsible for enforcing authentication across the application's REST endpoints.\u003c/p\u003e\n\u003cp\u003eBy design, the application fails to validate the identity of remote callers when interacting with REST controllers. This flaw exposes the entire API surface, including administrative functions, to unauthenticated actors. Attackers can leverage this exposure to query system endpoints, such as /api/v1/auth/users, to harvest plaintext passwords and API keys associated with configured LLM providers. Furthermore, the lack of access controls allows for the unauthorized creation of super-administrator accounts and arbitrary data manipulation (CRUD) across the platform. This vulnerability poses an immediate risk to any LangChat instance, enabling complete administrative takeover and persistent unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to exfiltrate highly sensitive data, including user plaintext passwords and LLM provider API keys. The ability to create super-admin accounts permits attackers to maintain persistence, modify system configurations, and delete or manipulate critical business data. Organizations utilizing LangChat for LLM orchestration are at risk of secondary supply chain attacks if LLM provider API keys are compromised, potentially leading to unauthorized costs or model poisoning.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict network access to the LangChat REST API from untrusted or public-facing network segments until the patch is applied.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized requests to the /api/v1/auth/users endpoint or suspicious creation of administrator-level accounts.\u003c/li\u003e\n\u003cli\u003eReview and rotate all API keys stored within the LangChat application if the system has been accessible from the internet.\u003c/li\u003e\n\u003cli\u003eUpgrade LangChat to a version post-dating commit 2a6285a once a vendor fix is available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:45:56Z","date_published":"2026-10-16T18:45:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-langchat-auth-bypass/","summary":"A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.","title":"Authentication Bypass in LangChat REST API","url":"https://feed.craftedsignal.io/briefs/2026-10-langchat-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:langchat:langchat:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}