CVE-2025-8850
In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.
Scoring
- Severity
- LOW
- CVSS base score
- 3.1
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.41%
- CWE
- CWE-440
- Published
- 2025-10-30
- Last modified
- 2026-03-12
Affected products
- danny-avila danny-avila/librechat
Weakness type
Related vulnerabilities
- CVE-2026-16769 — RS9116W/SiWx917 plaintext pause encryption request causes DOS
- CVE-2026-65934 — BT122 plaintext pause encryption request causes DOS
- CVE-2026-65932 — BT122 stops advertising
- CVE-2026-8806 — Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module
- CVE-2026-42752 — WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability
- CVE-2026-49316 — Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown
- CVE-2026-42534 — Jostle logic bypass degrades resolution performance
- CVE-2026-41136 — free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer