CVE-2026-54036: LibreChat 2FA enable endpoint lets authenticated user overwrite existing 2FA

Summary

LibreChat versions prior to 0.8.4-rc1 expose a GET /api/auth/2fa/enable endpoint that an authenticated user, or an attacker holding a stolen session, can call even when 2FA is already enabled. The call overwrites the existing TOTP secret, generates new backup codes and sets twoFactorEnabled to false, without any TOTP or backup code verification. This lets an attacker with a valid session token take over the victim's 2FA and lock the legitimate user out.

Mitigation

Fixed in 0.8.4-rc1.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News