GHSA-v492-6xx2-p57gLowCVSS 4.2
Chainlit contains an authorization bypass vulnerability
🔗 CVE IDs covered (1)
📋 Description
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
🎯 Affected products1
- pip/chainlit:< 2.8.5
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2025-68492
- https://github.com/Chainlit/chainlit/releases
- https://jvn.jp/en/jp/JVN34964581
- https://github.com/Chainlit/chainlit/pull/2637
- https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e
- https://github.com/Chainlit/chainlit/releases/tag/2.8.5
- https://github.com/advisories/GHSA-v492-6xx2-p57g