CVE-2026-54040

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description The application allows the regeneration of all two-factor authentication (2FA) backup codes without requiring a Time-based One-Time Password (TOTP) token or the verification of an existing backup code. An attacker possessing a stolen session token can replace a victim's backup codes to bypass 2FA login or disable 2FA completely. This issue occurs at the 'POST /api/auth/2fa/backup/regenerate' endpoint.

Recommendations Update to version 0.8.4-rc1.