CVE-2026-14204

The CVE concerns the Google Authenticator WordPress plugin prior to 0.56, where saving the 2FA setup does not verify a CSRF nonce. This allows a logged-in attacker to trick a user into overwriting their own 2FA secret with attacker‑controlled data, resulting in the attacker effectively controllin...

CVE-2026-54036 LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user or attacker with a stolen session even when 2FA is already fully enabled on the account. This endpoint overwrites the existi...