danny-avila LibreChat up to 0.8.4 /api/auth/2fa/enable missing authentication

Summaryinfo

A vulnerability was found in danny-avila LibreChat. It has been classified as critical. This affects an unknown function of the file /api/auth/2fa/enable. The manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-54036. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in danny-avila LibreChat. It has been rated as critical. This issue affects an unknown code block of the file /api/auth/2fa/enable. The manipulation with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-54036 since 06/11/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.8.4-rc1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• danny-avila

Name

• LibreChat

Version

• 0.7.5
• 0.7.6
• 0.7.7
• 0.7.8
• 0.7.9
• 0.7.9-rc1
• 0.8.0-rc2
• 0.8.1
• 0.8.1-rc2
• 0.8.2
• 0.8.2-rc2
• 0.8.2-rc3
• 0.8.3
• 0.8.3-rc1
• 0.8.3-rc2
• 0.8.4

Website

• Product: https://github.com/danny-avila/LibreChat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion