medium4.2
CVE-2025-68492
Chainlit contains an authorization bypass vulnerability
Impact
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | chainlit | < 2.8.5 | 2.8.5 |
Affected products
| Product | Affected versions |
|---|---|
| Chainlit | before 2.8.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Chainlit/chainlit/releases
- https://jvn.jp/en/jp/JVN34964581/
- https://github.com/advisories/GHSA-v492-6xx2-p57g
- https://nvd.nist.gov/vuln/detail/CVE-2025-68492
- https://jvn.jp/en/jp/JVN34964581
- https://github.com/Chainlit/chainlit/pull/2637
- https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e
- https://github.com/Chainlit/chainlit/releases/tag/2.8.5