Authentication Bypass in LibreChat by Danny Avila

CVE-2026-54040

What is CVE-2026-54040?

LibreChat prior to version 0.8.4-rc1 contains a significant vulnerability in its 2FA backup code regeneration process. Specifically, the system allows the POST /api/auth/2fa/backup/regenerate endpoint to regenerate all backup codes without the need for a Time-based One-Time Password (TOTP) token or verification of existing backup codes. This flaw means that an attacker with access to a victim's session token can alter the victim's backup codes without detection, potentially allowing them to bypass two-factor authentication altogether or disable it, drastically compromising user account security.

References