CVE-2026-54040: Librechat

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can silently replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. This vulnerability is fixed in 0.8.4-rc1.

Affected products

• Librechat Librechat: up to and including 0.8.3

Published 2026-06-25. Last modified 2026-06-29.