LibreChat permits an authenticated user, or an attacker who has stolen a session token, to call the /api/auth/2fa/enable endpoint even when two‑factor authentication (2FA) is already active. The request overwrites the user’s TOTP secret, generates new backup codes, and disables 2FA without requiring the current TOTPs or backup codes, effectively giving the attacker full control over the victim’s 2FA configuration and locking out the legitimate user.

The vulnerability affects all LibreChat releases produced by danny‑avila that precede version 0.8.4‑rc1. Any installation on these versions exposes user accounts to the possibility of 2FA takeover.

The CVSS score of 5.3 indicates moderate severity, and EPSS data is not available; the issue is not listed in CISA’s KEV catalog. However, the attack requires only a valid authenticated session, so an attacker who has compromised or stolen a session cookie can invoke the vulnerable endpoint and deactivate 2FA altogether. Because 2FA is a critical authentication layer, the practical impact on account security is high, and the vulnerability is fully remedied by installing the updated release that disables the insecure behavior.