GHSA-v492-6xx2-p57g

Chainlit contains an authorization bypass vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-68492

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	chainlit	< 2.8.5	2.8.5

Details

As written in the advisory (Markdown source, shown as plain text).

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-68492 advisory
https://github.com/Chainlit/chainlit/pull/2637 web
https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e web
https://github.com/Chainlit/chainlit package
https://github.com/Chainlit/chainlit/releases web
https://github.com/Chainlit/chainlit/releases/tag/2.8.5 web
https://jvn.jp/en/jp/JVN34964581 web