LangChat Missing Authentication Exposes Passwords, API Keys, and Admin Control (CVE-2026-111704)

A critical missing-authentication flaw in LangChat (through commit 2a6285a) lets unauthenticated remote attackers reach its REST controllers, read plaintext passwords and LLM provider API keys, and create super-admin accounts.

What Is It

CVE-2026-111704 is a missing authentication vulnerability (CWE-306) in LangChat. According to the NVD record, the application registers no Sa-Token interceptor, so its REST controllers can be reached without authentication. VulnCheck reported the issue, and NVD published it on 2026-10-16. NVD lists the record's status as "Deferred."

The description says an unauthenticated remote attacker can:

• Query /api/v1/auth/users to read plaintext user passwords
• Retrieve LLM provider API keys
• Create super-admin accounts
• Modify or delete data

Why It Matters

VulnCheck scores this flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (Critical). An attacker can exploit it over the network with low complexity. They need no privileges and no user interaction. Confidentiality, integrity, and availability impacts are all rated high.

The exposed data makes this worse than a typical auth bypass. Plaintext passwords can be reused against other systems, and stolen LLM provider API keys can be abused outside the LangChat deployment. Creating super-admin accounts also gives an attacker lasting administrative control of the application.

This CVE has no CISA KEV entry, so KEV does not currently confirm active exploitation.

What's Vulnerable

• Vendor/Product: LangChat / langchat
• Repository: https://github.com/LangChat/langchat
• Affected versions: All commits up to and including 2a6285a6b8c51d51cdc599771bb667a30bc03f5c (git-based versioning)

The NVD record lists no CPE entries.

Patch Status

The supplied NVD record names no fixed version or patch commit, and there is no CISA KEV required action or due date. Anyone running LangChat at or before commit 2a6285a should treat the instance as exposed. Check the VulnCheck advisory and the upstream repository for remediation guidance. Until a fix is confirmed, restrict network access to the LangChat API, and rotate any user passwords and LLM provider API keys stored in affected instances.

Sources

• NVD, CVE-2026-111704
• VulnCheck Advisory; LangChat Missing Authentication on REST API Controllers
• Researcher Write-up (HackMD), LangChat Missing Global Auth & Credential Exposure
• GitHub; AigcUserController.java (affected code)
• GitHub; AuthServiceImpl.java (affected code)
• GitHub; WebAsyncConfig.java (affected code)