CVE-2026-54036 Details
Description
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.
A vulnerability in LibreChat versions prior to 0.8.4-rc1 allows an authenticated user or an attacker with a stolen session to exploit the GET /api/auth/2fa/enable endpoint. This endpoint can be called even when two-factor authentication (2FA) is already fully enabled on the account. The vulnerability arises because the endpoint overwrites the existing TOTP secret, generates new backup codes, and disables 2FA, all without requiring any verification of the TOTP or backup codes. As a result, an attacker with a valid session token can take over a victim's 2FA, locking the legitimate user out of their own authentication.
Users should update to LibreChat version 0.8.4-rc1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-45fp-6q26-wfgq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-45fp-6q26-wfgq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| librechat librechat | <= 0.8.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |