CVE-2026-54036 in LibreChat
Summary
by MITRE • 06/25/2026
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/25/2026
The vulnerability in LibreChat prior to version 0.8.4-rc1 represents a critical security flaw in the authentication system that undermines the integrity of two-factor authentication mechanisms. This weakness exists within the GET /api/auth/2fa/enable endpoint which is designed to facilitate the enabling of two-factor authentication for user accounts. The endpoint's implementation fails to properly validate whether 2FA is already active on an account before proceeding with the modification process, creating a significant bypass opportunity for malicious actors.
The technical flaw stems from improper access control and state validation within the authentication workflow. When an authenticated user or attacker with a stolen session token accesses this endpoint, the system performs a blind overwrite of the existing Time-based One-Time Password (TOTP) secret without requiring verification of the current 2FA status or any form of authentication proof. The endpoint executes three critical operations in sequence: overwriting the existing TOTP secret, generating new backup codes, and setting the twoFactorEnabled flag to false. This sequence effectively neutralizes the existing 2FA configuration while providing no mechanism for legitimate verification of the user's intent to modify their authentication settings.
The operational impact of this vulnerability is severe and directly enables account takeover scenarios. An attacker with a valid session token can completely compromise a victim's two-factor authentication setup by calling this endpoint, thereby locking out the legitimate user from their own account. This creates a situation where the victim loses access to their account entirely while the attacker gains complete control over the compromised credentials. The vulnerability essentially allows for a form of privilege escalation within the authentication system, where an authenticated user can manipulate their own security settings without proper verification, and an attacker with session theft can perform similar modifications. This flaw directly violates security principles established in the CWE (Common Weakness Enumeration) catalog under categories related to improper access control and insufficient verification of authentication state.
This vulnerability aligns with several ATT&CK framework techniques including T1566 for credential harvesting through session hijacking, and T1078 for valid accounts usage. The flaw represents a failure in the principle of least privilege and proper session management, as the system should require explicit verification of existing 2FA status before allowing modifications to authentication settings. The lack of proper state validation creates an attack surface that allows for unauthorized modification of security configurations without appropriate authorization checks. Organizations using affected versions of LibreChat face significant risk of account compromise and potential data breaches due to this vulnerability, making the upgrade to version 0.8.4-rc1 or later essential for maintaining secure authentication practices and protecting user accounts from unauthorized access attempts.