CVE-2026-54036

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description An authenticated user or an attacker with a stolen session can access the 'GET /api/auth/2fa/enable' endpoint even if two-factor authentication (2FA) is already active. This action overwrites the current Time-based One-Time Password (TOTP) secret, generates new backup codes, and sets the twoFactorEnabled variable to false without requiring any verification. Consequently, an attacker with a valid session token can seize control of the 2FA settings and lock the legitimate user out of their account.

Recommendations Update to version 0.8.4-rc1.