Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-41258 LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API. https://www.cve.org/CVERecord?id=CVE-2025-41258
Post summary
The CVE-2025-41258 vulnerability in LibreChat arises from using the same JWT secret for session and RAG API authentication, exposing the service to compromise.
CVE-2025-41258 LibreChat 0.8.1-rc2 JWT Secret Reuse Compromising RAG API Authentication https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-41258
Post summary
The CVE-2025-41258 vulnerability involves JWT secret reuse in LibreChat 0.8.1‑rc2, compromising RAG API authentication.
🟠 CVE-2025-41258 - High LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API. https://www.thehackerwire.com/vulnerability/CVE-2025-41258/ https://t.co/WsKiIkw0M2
Post summary
The tweet announces that LibreChat v0.8.1-rc2 reuses a JWT secret for both user sessions and the RAG API, exposing a high‑severity authentication flaw.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | librechat | librechat | 0.8.1 | - | - |