Missing Authentication Vulnerability in LangChat by LangChat Inc.

CVE-2026-111704

What is CVE-2026-111704?

LangChat contains a missing authentication vulnerability that enables unauthenticated remote attackers to exploit REST controllers. This oversight allows attackers to query endpoints such as /api/v1/auth/users, potentially exposing plaintext passwords, LLM provider API keys, and facilitating the creation of super-admin accounts. Data integrity can be compromised as attackers may modify or delete critical data without authorization.

References