CVE-2026-36719 Details

A vulnerability allowing information disclosure exists in AgentChat versions through 2.3.0, specifically in the /api/v1/user/info endpoint. This vulnerability allows unauthenticated attackers to access sensitive information, including unsalted SHA256 password hashes, by enumerating user IDs. The user query functionality fails to properly filter database fields, exposing password hashes that can be reversed using rainbow table attacks or online hash cracking services, thereby compromising user account security.

To address this vulnerability, implement proper filtering of API responses to exclude sensitive information such as password hashes. Additionally, use cryptographically secure salted password hashing algorithms, like bcrypt, and apply authentication and authorization checks to restrict access to user information.