EUVD-2026-39456Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network endpoint with no UI and low complexity, but a valid session is required (PR:L); regenerating backup codes is a high integrity hit (I:H) with minor confidentiality exposure (C:L) and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can silently replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. This vulnerability is fixed in 0.8.4-rc1.
AnalysisAI
Authentication-bypass weakness in LibreChat before 0.8.4-rc1 lets an attacker who already holds a valid session silently regenerate all of a victim's two-factor backup codes via POST /api/auth/2fa/backup/regenerate, which never asks for a current TOTP token or an existing backup code. With fresh codes in hand, the attacker can bypass 2FA at login or turn 2FA off entirely, neutralizing the account's second factor. EPSS is low (0.15%, 5th percentile) and no active exploitation is recorded, but proof-of-concept exploitation is acknowledged in the SSVC framework.
Technical ContextAI
LibreChat is a self-hosted, open-source multi-provider ChatGPT-style web application (CPE cpe:2.3:a:danny-avila:librechat). The flaw is rooted in CWE-306 (Missing Authentication for a Critical Function): the backup-code regeneration endpoint is a security-critical operation that should re-verify possession of the second factor (a valid TOTP code or an existing backup code) before issuing new recovery codes, but it performs no such step-up check. Because backup codes are the recovery path that intentionally circumvents the TOTP requirement at login, regenerating them without re-authentication effectively hands the attacker a permanent 2FA bypass tied only to a session cookie rather than to the authenticator secret.
RemediationAI
Vendor-released patch: 0.8.4-rc1 - upgrade LibreChat to 0.8.4-rc1 or later as the primary fix, per advisory GHSA-h59w-x9h4-m6gv (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-h59w-x9h4-m6gv). If immediate upgrade is not possible, reduce exposure to the prerequisite (a valid stolen session): shorten session/JWT lifetimes and rotate session secrets to invalidate long-lived tokens, enforce Secure/HttpOnly/SameSite cookies and TLS to cut session theft, and where feasible restrict or block the POST /api/auth/2fa/backup/regenerate route at a reverse proxy until patched (trade-off: legitimate users cannot regenerate backup codes while blocked). Operationally, monitor for unexpected backup-code regeneration events and force re-enrollment of 2FA for accounts suspected of session compromise.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), th
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this v
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltra
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today