{"id":"CVE-2026-111704","published":"2026-10-16T18:17:54.370","lastModified":"2026-10-16T19:03:18.127","description":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60","tags":[]},{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58","tags":[]},{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure","tags":[]},{"url":"https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-authentication-on-rest-api-controllers","tags":[]}],"exploitRefs":[{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60","tags":[]},{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58","tags":[]},{"url":"https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33","tags":[]}],"hasPoc":true,"ai":{"summary":"LangChat has a critical authentication bypass vulnerability where unauthenticated users can access protected REST controllers and read plaintext passwords, LLM API keys, and create admin accounts. This allows full system compromise without any credentials.","exploitability":"Very easy to exploit with no preconditions - attackers simply need to access the vulnerable endpoints to gain full administrative access and data control.","blast_radius":"High impact in real-world scenarios as attackers can steal sensitive API keys, create persistent admin accounts, and modify/delete all system data without detection.","remediation":"Apply the fix from commit 2a6285a which registers the missing Sa-Token interceptor to secure REST controllers.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","web","credential-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:15.129Z"}}