EUVD-2026-39456Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid victim session token
-
DeliveryCall /api/auth/2fa/backup/regenerate
-
ExploitServer issues new backup codes without TOTP check
-
ExecutionUse codes to bypass or disable 2FA
-
ImpactPersistent account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold a valid authenticated session token for the target LibreChat account (PR:L) and an account that has 2FA enabled with backup codes available; the specific exploited feature is the POST /api/auth/2fa/backup/regenerate endpoint, which omits any TOTP-or-existing-backup-code re-verification. Exploitation is limited by the need for a pre-existing valid session (no path from a fully unauthenticated attacker) and is confined to versions before 0.8.4-rc1; no user interaction, special platform, or non-default configuration is otherwise needed once a session is held. |
| Impact | Signals are internally consistent and point to a real but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1 High) shows network reach, low complexity, no user interaction, and high integrity impact, but PR:L confirms the attacker must already possess a valid authenticated session - this is a privilege-escalation/persistence step against an already-compromised session, not an unauthenticated takeover. SSVC corroborates this: Exploitation=poc, Automatable=no, Technical Impact=partial. EPSS is low at 0.15% (5th percentile) and the CVE is not on CISA KEV, so there is no evidence of widespread or automated exploitation. Net: prioritize patching for any internet-exposed LibreChat instance, but the precondition of a stolen/valid session means this is a second-stage risk rather than a mass-exploitation emergency. |
| Exploit ScenarioDerived | An attacker steals or hijacks a logged-in user's LibreChat session token (e.g., via XSS, a leaked cookie, or a shared/compromised device) and sends a single POST to /api/auth/2fa/backup/regenerate. The server returns a brand-new set of backup codes without prompting for the victim's TOTP, letting the attacker log in past 2FA or disable 2FA outright; a proof-of-concept for this behavior is acknowledged in the SSVC data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Authentication-bypass weakness in LibreChat before 0.8.4-rc1 lets an attacker who already holds a valid session silently regenerate all of a victim's two-factor backup codes via POST /api/auth/2fa/backup/regenerate, which never asks for a current TOTP token or an existing backup code. With fresh codes in hand, the attacker can bypass 2FA at login or turn 2FA off entirely, neutralizing the account's second factor. EPSS is low (0.15%, 5th percentile) and no active exploitation is recorded, but proof-of-concept exploitation is acknowledged in the SSVC framework.
Earlier versions of this analysis (2)
Authentication bypass in LibreChat before 0.8.4-rc1 lets an attacker who holds a stolen session token call POST /api/auth/2fa/backup/regenerate to silently regenerate a victim's two-factor backup codes without supplying any existing TOTP token or backup code. The freshly generated codes can then be used to satisfy the 2FA challenge at login or to disable 2FA outright, neutralizing the account's second factor. The flaw is fixed in 0.8.4-rc1; a GitHub Security Advisory exists with publicly available exploit code (SSVC PoC), though it is not on CISA KEV and EPSS is low at 0.15%.
LibreChat's 2FA backup code regeneration endpoint prior to 0.8.4-rc1 performs no secondary identity verification before replacing a user's entire set of backup codes. An attacker holding a stolen session token can silently call POST /api/auth/2fa/backup/regenerate to overwrite the victim's backup codes with attacker-controlled ones, then leverage those codes to bypass 2FA at login or fully disable 2FA on the account. No public exploit code is identified and no CISA KEV listing is present; however, the attack chain is straightforward for any actor who can obtain a valid session token.
RemediationAI
Vendor-released patch: 0.8.4-rc1 - upgrade LibreChat to 0.8.4-rc1 or later as the primary fix, per advisory GHSA-h59w-x9h4-m6gv (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-h59w-x9h4-m6gv). If immediate upgrade is not possible, reduce exposure to the prerequisite (a valid stolen session): shorten session/JWT lifetimes and rotate session secrets to invalidate long-lived tokens, enforce Secure/HttpOnly/SameSite cookies and TLS to cut session theft, and where feasible restrict or block the POST /api/auth/2fa/backup/regenerate route at a reverse proxy until patched (trade-off: legitimate users cannot regenerate backup codes while blocked). Operationally, monitor for unexpected backup-code regeneration events and force re-enrollment of 2FA for accounts suspected of session compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LibreChat is a self-hosted, open-source multi-provider ChatGPT-style web application (CPE cpe:2.3:a:danny-avila:librechat). The flaw is rooted in CWE-306 (Missing Authentication for a Critical Function): the backup-code regeneration endpoint is a security-critical operation that should re-verify possession of the second factor (a valid TOTP code or an existing backup code) before issuing new recovery codes, but it performs no such step-up check. Because backup codes are the recovery path that intentionally circumvents the TOTP requirement at login, regenerating them without re-authentication effectively hands the attacker a permanent 2FA bypass tied only to a session cookie rather than to the authenticator secret.
Know when Librechat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network endpoint with no UI and low complexity, but a valid session is required (PR:L); regenerating backup codes is a high integrity hit (I:H) with minor confidentiality exposure (C:L) and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates all 2FA backup codes without requiring any TOTP token or existing backup code verification. An attacker with a stolen session token can silently replace a victim's backup codes and use them to bypass 2FA login or disable 2FA entirely. This vulnerability is fixed in 0.8.4-rc1.
Executive ViewAI
LibreChat versions before 0.8.4-rc1 contain an authentication-bypass weakness affecting users with 2FA enabled; an attacker with access to a valid user session can silently disable all two-factor backup codes, completely circumventing this critical account protection. While publicly available exploit code exists, no active exploitation has been observed in the wild. This vulnerability transforms credential compromise into complete account takeover for affected users, making immediate patching a priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat 0.7.9 lets an authenticated user turn off two-factor authentication on their own account without supplying a v
Stored cross-site scripting and tracker injection in LibreChat 0.8.0 and earlier allow a user who can create a chat to c
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. Rated high severity (CVSS 7.5),
Unbounded `key` and `value` parameters on the LibreChat 0.7.9 memory API (`POST /api/memories` and `PATCH /api/memories/
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
Exploit-DB