CVE-2026-54040 | LibreChat is an enhanced ChatGPT clone that supports multipl… | CVSS 5.9 MEDIUM

Description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can silently replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. This vulnerability is fixed in 0.8.4-rc1.

Metadata

CVE ID: CVE-2026-54040
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-11 16:57 UTC
Published: 2026-06-25 15:45 UTC
Last updated: 2026-06-25 18:13 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: danny-avila / LibreChat
Sources: cve.org · NVD

Severity & Metrics

5.9 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
danny-avila	LibreChat	—	< 0.8.4-rc1

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306: Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.9	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

References (1)

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-h59w-x9h4-m6gv https://github.com/danny-avila/LibreChat/security/advisories/GHSA-h59w-x9h4-m6gv