CVE-2025-68492: Chainlit Authorization Bypass Vulnerability
Summary
CVE-2025-68492: Chainlit contains an authorization bypass vulnerability. Affects chainlit versions < 2.8.5. Fixed in 2.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chainlit is an open-source framework designed for building and deploying interactive applications using Python. It allows developers to create user-friendly interfaces for machine learning models and other applications. However, certain versions of Chainlit are vulnerable to an authorization bypass issue that can compromise user data and application integrity.
Vulnerability Detail
Chainlit versions prior to 2.8.5 are susceptible to an authorization bypass due to a flaw in user-controlled key management. This vulnerability allows an attacker, who has logged into the application, to access threads that they should not have permission to view or even take ownership of those threads. The potential ramifications include unauthorized access to sensitive information and manipulation of application data, which can lead to data breaches and loss of user trust.
How To Fix
Minimum fixed version
2.8.5
This is the first release that contains the fix.
pip install --upgrade "chainlit==2.8.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to fully mitigate the risk without updating to the patched version. Users are strongly advised to upgrade to version 2.8.5 or later as soon as possible.
Conclusion
The authorization bypass vulnerability in Chainlit poses a significant risk to applications using versions prior to 2.8.5. It is crucial for users to update to the latest version to protect their applications from unauthorized access and potential data breaches. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain application security.
See every vulnerability recorded for chainlit →
FAQ
The vulnerability is an authorization bypass that allows unauthorized users to access or take ownership of threads.
All versions of Chainlit prior to 2.8.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to fix this vulnerability may lead to unauthorized access to sensitive threads and data, potentially resulting in data breaches.
The CVSS score of this vulnerability is 4.2, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for chainlit.
