Advisoriesby IbischainlitGHSA-v492-6xx2-p57g
Chainlit contains an authorization bypass vulnerability
Fix: upgrade to 2.8.5 or later
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| chainlit PyPI | < 2.8.5 | 2.8.5 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639
- Also known as
- CVE-2025-68492, PYSEC-2026-1238
More chainlit advisories
All chainlit
chainlit: server-side request forgeryCVE-2026-120492fixed in 2.12.0Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code executionCVE-2026-45018fixed in 2.12.0Chainlit contains a session hijacking vulnerabilityCVE-2026-56104fixed in 2.10.1Chainlit contain a server-side request forgery (SSRF) vulnerabilityCVE-2026-22219fixed in 2.9.4chainlit: arbitrary file readCVE-2026-22218fixed in 2.9.4