{"data":{"id":"c0cd1955-cdf9-4758-b91f-1a045ec15e0d","title":"CVE-2026-54036: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET…","summary":"LibreChat versions prior to 0.8.4-rc1 expose a GET /api/auth/2fa/enable endpoint that an authenticated user, or an attacker holding a stolen session, can call even when 2FA is already enabled. The call overwrites the existing TOTP secret, generates new backup codes and sets twoFactorEnabled to false, without any TOTP or backup code verification. This lets an attacker with a valid session token take over the victim's 2FA and lock the legitimate user out.","solution":"Fixed in 0.8.4-rc1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54036","publishedAt":"2026-06-25T16:16:39.217Z","cveId":"CVE-2026-54036","cweIds":["CWE-306"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LibreChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LibreChat 2FA enable endpoint lets authenticated user overwrite existing 2FA","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00383,"epssCheckedAt":"2026-11-10T00:11:22.945Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-10T00:11:46.040Z","patchAvailable":null,"disclosureDate":"2026-06-25T16:16:39.217Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}