Vulnerability in LibreChat Affects Two-Factor Authentication Functionality

CVE-2026-54036

What is CVE-2026-54036?

A critical flaw in LibreChat allows an authenticated user or an attacker with a compromised session to call the /api/auth/2fa/enable endpoint even when two-factor authentication is fully activated. This vulnerability enables the attacker to overwrite the existing TOTP secret, generate new backup codes, and effectively disable two-factor authentication without any verification. As a result, the legitimate user can lose access to their two-factor authentication, making them vulnerable to account takeovers. The issue is addressed in version 0.8.4-rc1.

References