Executive brief
LibreChat is an open-source interface for interacting with various AI models. A security flaw allowed users to regenerate their two-factor authentication (2FA) backup codes without providing any secondary verification. If an attacker manages to steal a user's active session token, they can use this flaw to replace the victim's backup codes with their own, effectively locking the user out or disabling 2FA protections entirely to maintain permanent access to the account.
Technical details
The vulnerability exists in the `POST /api/auth/2fa/backup/regenerate` endpoint within `api/server/controllers/TwoFactorController.js`. The `regenerateBackupCodes` function only requires a valid JWT (via `requireJwtAuth` middleware) but fails to implement a secondary check for a TOTP token or an existing backup code before generating and returning new plaintext codes. An attacker with a compromised session token can call this endpoint to obtain new backup codes, which can then be used to disable 2FA via the `/api/auth/2fa/disable` endpoint or bypass 2FA during login. The issue was addressed in version 0.8.4-rc1 by requiring proper verification for critical 2FA operations.
Affected products
- danny-avila LibreChat < 0.8.4-rc1
Timeline
- 2026-06-02: advisory: GitHub Security Advisory GHSA-h59w-x9h4-m6gv published
- 2026-06-25: disclosed: CVE-2026-54040 published to NVD
- 2026-06-25: patched: Fix released in version 0.8.4-rc1