LangChat Missing Authentication Vulnerability

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered.

Attackers can exploit this flaw to:

• Query /api/v1/auth/users to read plaintext passwords
• Retrieve LLM provider API keys
• Create super-admin accounts
• Modify or delete data