CVE-2026-54036 describes a missing authentication check for a critical function in danny-avila's LibreChat. Specifically, before version 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be invoked by an authenticated user or an attacker with a stolen session token even if 2FA is already enabled. This endpoint resets the TOTP secret, generates new backup codes, and disables 2FA without requiring verification via TOTP or backup codes. This allows an attacker to fully take over the victim's 2FA protection, effectively bypassing two-factor authentication controls. The vulnerability is addressed in version 0.8.4-rc1.

An attacker with a valid session token can disable two-factor authentication on a victim's account without additional verification, enabling account takeover by locking the legitimate user out of their 2FA. This compromises the integrity of the authentication mechanism and increases the risk of unauthorized access. There is no indication of confidentiality or availability impact beyond the loss of 2FA protection.

Upgrade LibreChat to version 0.8.4-rc1 or later, where this vulnerability is fixed. There is no official vendor advisory specifying alternative mitigations or temporary fixes. Until patched, restrict access to authenticated sessions and monitor for suspicious session activity to reduce risk.