UpHeron
All vulnerabilities

Servers and applications

CVE-2025-8850

In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is…

Severity
High 8.8
Published
30 Oct 2025
Last changed
7 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
LibreChatServers and applications · cpe:a:librechat:librechat
  • Version 0.7.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-8850
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-8850