LibreChat versions before 0.8.4-rc1 contain a flaw that allows a user with a valid session token to regenerate all two‑factor authentication backup codes without providing any one‑time password or existing backup code. This flaw permits the replacement of a victim’s backup codes, enabling an attacker to log in without providing the required challenge code or to disable two‑factor authentication entirely. The weakness is reflected by CWE‑306, which describes missing authentication of an operation that requires privileged verification.

The vulnerability affects the LibreChat application provided by the vendor Danny‑Avila. Authenticated users running any version older than 0.8.4-rc1 are susceptible; all newer releases implement the required OTP or backup‑code check prior to regeneration.

The CVSS score of 5.9 indicates a medium severity vulnerability. Attackers need only a stolen or otherwise legitimate session cookie, which could arise from phishing, credential stuffing or session hijacking. Because no additional verification is required, the exploit likelihood is high for compromised accounts, and it results in complete bypass of an important security boundary. The EPSS score is not available, but the lack of a KEV listing suggests that known exploits have not yet been observed, though the attack surface remains significant.