CVE-2026-54036: LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user (or attacker with a stolen session) even when 2FA is already fully enabled on the account. This endpoint overwrites the existing TOTP secret, generates new backup codes, and sets twoFactorEnabled to false — all without requiring any TOTP or backup code verification. An attacker with a valid session token can completely take over a victim's 2FA, locking the legitimate user out of their own two-factor authentication. This vulnerability is fixed in 0.8.4-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreChatto a version that resolves this vulnerability.Fixed in 0.8.4-rc1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54036?
CVE-2026-54036 has a medium severity rating of 5.3.
How do I fix CVE-2026-54036?
To fix CVE-2026-54036, update LibreChat to version 0.8.4-rc1 or later, where the vulnerability is patched.
What does CVE-2026-54036 exploit?
CVE-2026-54036 exploits the ability for an authenticated user to re-enable 2FA without OTP verification even when it is already enabled.
Can an attacker use CVE-2026-54036 without physical access?
Yes, an attacker can exploit CVE-2026-54036 remotely if they have a stolen session.
What is the impact of CVE-2026-54036?
The impact of CVE-2026-54036 allows an attacker to take over an account's 2FA settings, potentially leading to full account takeover.