CVE-2026-54040: LibreChat 2FA Backup Code Regeneration Flaw (MEDIUM)

Technical summary

The POST /api/auth/2fa/backup/regenerate endpoint in LibreChat prior to version 0.8.4-rc1 fails to enforce proper authorization checks. The endpoint does not require submission of a valid TOTP token or verification of an existing backup code before allowing the regeneration of all backup codes. An attacker with a valid session token (obtained through phishing, credential compromise, or session hijacking) can invoke this endpoint and receive a new set of backup codes that supersede the legitimate user's codes. Because 2FA backup codes are typically single-use, high-entropy secrets meant to recover account access when the primary 2FA method is unavailable, their unverified regeneration creates a direct path to account takeover. The vulnerability maps to CWE-306 (Missing Authentication for Critical Function).

Business impact

For organizations or individuals using LibreChat, this vulnerability undermines the security guarantees of two-factor authentication. An attacker with session access can completely bypass the second factor without triggering any alerts, effectively reducing MFA protection to single-factor authentication. The silent nature of the attack means victims may remain unaware of the compromise until unauthorized access occurs. For LibreChat deployments in enterprise or healthcare environments where compliance (HIPAA, SOC 2, ISO 27001) requires functional MFA, this flaw represents a material control failure that could lead to audit findings or regulatory action.

Affected systems

LibreChat versions before 0.8.4-rc1 are affected. This includes stable releases and pre-release versions up to and including 0.8.3. The vulnerability requires an attacker to first obtain a valid session token, which means the attack assumes prior compromise of session credentials or tokens through separate means (e.g., credential theft, XSS, or device compromise).

Exploitability

The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects that while the vulnerability is accessible over the network and requires low privileges (an authenticated session), it is not trivially exploitable. An attacker must already possess a valid session token, which raises the complexity. However, once that token is in hand, exploitation is automatic and requires no user interaction. The attack is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the silent nature and the critical role of backup codes in 2FA recovery make this a concern for active monitoring.

Remediation

Upgrade LibreChat to version 0.8.4-rc1 or later, which implements proper authorization checks on the 2FA backup code regeneration endpoint. Verify against the vendor advisory that the patched version includes TOTP or backup code verification before regenerating codes. Organizations should also review session management practices (enforce short session timeouts, use secure token storage) and monitor authentication logs for suspicious regeneration patterns.

Patch guidance

Apply the update to LibreChat 0.8.4-rc1 or later as soon as testing permits. Since this is marked as an rc (release candidate), confirm with the vendor timeline for a stable 0.8.4 release. If your deployment is critical and you cannot immediately upgrade to rc, implement compensating controls: monitor for unexpected 2FA backup code regeneration events, enforce strict session timeout policies (e.g., 30-minute inactivity timeout), and consider requiring re-authentication (TOTP) before any sensitive settings changes.

Detection guidance

Monitor application logs for unusual patterns in the POST /api/auth/2fa/backup/regenerate endpoint usage. Establish a baseline for backup code regeneration frequency per user (typically rare) and alert on anomalies. Correlate regeneration events with geographic or IP-based session changes. Implement audit logging that records the source IP, timestamp, and user identity for all 2FA configuration changes. Review access logs for sessions that authenticate from unusual locations or at odd hours and then trigger 2FA modifications.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for rapid patching because it directly defeats multi-factor authentication—a critical compensating control for many organizations. The silent attack surface and the low friction of exploitation (once session access is obtained) mean that organizations relying on LibreChat for sensitive workloads should treat this as a near-critical issue. Prioritize patching if LibreChat instances handle regulated data or are exposed to high-value user accounts.

Risk score, explained

The CVSS 5.9 MEDIUM rating reflects the prerequisite of already-compromised session credentials, which limits the immediate threat vector. However, the impact is severe: confidentiality is slightly affected (user can access account), but integrity is highly affected (attacker can disable 2FA and take over the account). The attack avoids causing denial of service, hence availability is unaffected. The rating appropriately penalizes exploitability (AC:H due to the need for prior session compromise) while acknowledging the high integrity impact of backup code manipulation.

Frequently asked questions