LibreChat 2FA Re-enrollment Vulnerability Allows Full Account Takeover Without OTP (GHSA-45fp-6q26-wfqg)

Vulnerability Overview Title: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification Description: Vulnerability Name: 2FA re-enrollment allows full takeover of account 2FA without OTP verification. Vulnerability ID: GHSA-45fp-6q26-wfqg Severity: 5.3 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Details: Affected Versions: <= 0.8.3+rc1 Fixed Versions: v0.8.4+rc1 Vulnerable Code: Proof of Concept (PoC): Prerequisites: A running LibreChat instance and (install via ). Step 1: Register a user and log in to obtain the JWT token. Step 2: Enable and confirm 2FA (initial setup). Step 3: Exploitation - Re-call while 2FA is already enabled (no OTP required). Result: Returns 200 OK with a new TOTP secret and new backup codes. The old TOTP secret is overwritten, and is set to . Step 4: The attacker confirms 2FA under their control. Impact: This is a complete 2FA takeover vulnerability. An attacker who obtains the victim's session (e.g., via XSS, session hijacking, shared computer, etc.) can: 1. Replace the victim's existing TOTP secret with one controlled by the attacker. 2. Invalidate all of the victim's existing backup codes. 3. Lock the victim out of their own 2FA. 4. Re-enable 2FA under the attacker's full control. Remediation: Affected Versions: <= 0.8.3+rc1 Fixed Versions: v0.8.4+rc1 Summary This vulnerability allows an attacker to fully take over a user's 2FA settings without OTP verification, resulting in the user being locked out of their own account. The fix is to upgrade to version v0.8.4+rc1.

Goal Reached Thanks to every supporter — we hit 100%!

LibreChat 2FA Re-enrollment Vulnerability Allows Full Account Takeover Without OTP (GHSA-45fp-6q26-wfqg)

More from this source