Is CVE-2026-54040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54040 being exploited in the wild.

How severe is CVE-2026-54040?

Medium severity, with a CVSS score of 5.9, published 25 June 2026.

Is there a fix for CVE-2026-54040?

A patch was published on 2026-06-25: Fix released in version 0.8.4-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54040 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54040?

Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54040: LibreChat 2FA bypass via unauthenticated backup code regeneration

CVE-2026-54040 · Severity: medium · CVSS 5.9 · Published 2026-06-25

LibreChat is an open-source interface for interacting with various AI models. A security flaw allowed users to regenerate their two-factor authentication (2FA) backup codes without providing any secondary verification. If an attacker manages to steal a user's active session token, they can use this flaw to replace the victim's backup codes with their own, effectively locking the user out or disabling 2FA protections entirely to maintain permanent access to the account.

Technologies: LibreChat. Vendors: LibreChat.

Quick answers

Is CVE-2026-54040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54040 being exploited in the wild.
How severe is CVE-2026-54040?: Medium severity, with a CVSS score of 5.9, published 25 June 2026.
Which products and versions are affected?: LibreChat < 0.8.4-rc1.
Is there a fix for CVE-2026-54040?: A patch was published on 2026-06-25: Fix released in version 0.8.4-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54040 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54040?: Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `POST /api/auth/2fa/backup/regenerate` endpoint within `api/server/controllers/TwoFactorController.js`. The `regenerateBackupCodes` function only requires a valid JWT (via `requireJwtAuth` middleware) but fails to implement a secondary check for a TOTP token or an existing backup code before generating and returning new plaintext codes. An attacker with a compromised session token can call this endpoint to obtain new backup codes, which can then be used to disable 2FA via the `/api/auth/2fa/disable` endpoint or bypass 2FA during login. The issue was addressed in version 0.8.4-rc1 by requiring proper verification for critical 2FA operations.

Affected products

danny-avila LibreChat < 0.8.4-rc1

Timeline

2026-06-02: advisory: GitHub Security Advisory GHSA-h59w-x9h4-m6gv published
2026-06-25: disclosed: CVE-2026-54040 published to NVD
2026-06-25: patched: Fix released in version 0.8.4-rc1

References

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-h59w-x9h4-m6gv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.