CVE-2026-111704CWE-306

CVE-2026-111704

Critical · published October 16, 2026

CVSS v3.1

9.8

EPSS

Percentile

42.5

In the wild

Unconfirmed

What it is

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00508 · 42.5th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-10-16T22:17Z

References (6)

https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60 · [email protected]https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58 · [email protected]https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33 · [email protected]https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure · [email protected]https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-authentication-on-rest-api-controllers · [email protected]https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

18 OCT 03:27Z
EPSS moved — → 1%
epss
16 OCT 17:39Z
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
cvelistv5
16 OCT 17:39Z
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
cvelistv5