CVE-2026-54040: LibreChat 2FA backup code regeneration without authentication

Summary

CVE-2026-54040 affects LibreChat before 0.8.4-rc1. The POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring a TOTP token or existing backup code, so an attacker holding a stolen session token can replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. The weakness is classified as CWE-306, Missing Authentication for Critical Function.

Mitigation

Fixed in 0.8.4-rc1.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News