LangChat: Missing authentication on REST API controllers

Summary

LangChat through commit 2a6285a registers no Sa-Token authentication interceptor, so its REST controllers can be reached without login. A remote, unauthenticated attacker can query /api/v1/auth/users to read plaintext passwords and LLM provider API keys, create super-admin accounts, and modify or delete data. No authentication or user interaction is required.

Affected

• LangChat through commit 2a6285a6b8c51d51cdc599771bb667a30bc03f5c
• Versions and commits after this commit: Unknown.

Fixed in

Unknown. No patched version or vendor advisory was identified at the time of writing.

Workaround

• Register the Sa-Token interceptor across all relevant URL patterns, as recommended by the vendor-linked advisory.
• Until a fix is available, restrict network access to the LangChat backend (VPN or IP allowlist) and do not expose its API ports to the internet.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
• No evidence of exploitation in the wild was found in the sources reviewed.
• A third-party write-up exists; its PoC status was not verified.

Our recommendation

• Check whether any LangChat instance is reachable from the internet or untrusted networks, and restrict access immediately.
• Review the user table for unexpected super-admin accounts and check audit logs for calls to /api/v1/auth/users.
• Rotate LLM provider API keys and user passwords, and reset reused passwords on other services.
• Monitor the upstream project for a fixed release and update as soon as one is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-111704 advisory (VulnCheck) www.vulncheck.com
• Research write-up (HackMD) hackmd.io
• AigcUserController.java at 2a6285a github.com
• AuthServiceImpl.java at 2a6285a github.com
• WebAsyncConfig.java at 2a6285a github.com
• CVE-2026-111704 (VulDB) vuldb.com
• CVE-2026-111704 (TheHackerWire) www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:23.