CVE-2025-8850

In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/danny-avila/librechat/commit/7e4c8a5d0d2dbe5bf8fd272ff6acafb27d24744f	Patch
https://huntr.com/bounties/8e615709-f4de-41e2-b194-f0d91ed7c75e	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En la versión 0.7.9 de danny-avila/librechat, existe un problema de diseño de API inseguro en el flujo de autenticación de dos factores (2FA). El sistema permite a los usuarios deshabilitar la 2FA sin requerir un código OTP o de respaldo válido, eludiendo el proceso de verificación previsto. Esta vulnerabilidad ocurre porque el backend no valida correctamente el código OTP o de respaldo cuando se accede directamente al endpoint de la API '/api/auth/2fa/disable'. Esta falla puede ser explotada por usuarios autenticados para debilitar la seguridad de sus propias cuentas, aunque no conduce a un compromiso total de la cuenta.

Information

Published : 2025-10-30 20:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-8850

Mitre link : CVE-2025-8850

CVE.ORG link : CVE-2025-8850

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-440

Expected Behavior Violation

{"id": "CVE-2025-8850", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8850", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T14:57:10.072224Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "danny-avila", "product": "danny-avila/librechat", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v0.8.0-rc2", "versionType": "custom"}]}]}], "published": "2025-10-30T20:15:39.633", "references": [{"url": "https://github.com/danny-avila/librechat/commit/7e4c8a5d0d2dbe5bf8fd272ff6acafb27d24744f", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/8e615709-f4de-41e2-b194-f0d91ed7c75e", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-440"}]}], "descriptions": [{"lang": "en", "value": "In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise."}, {"lang": "es", "value": "En la versi\u00f3n 0.7.9 de danny-avila/librechat, existe un problema de dise\u00f1o de API inseguro en el flujo de autenticaci\u00f3n de dos factores (2FA). El sistema permite a los usuarios deshabilitar la 2FA sin requerir un c\u00f3digo OTP o de respaldo v\u00e1lido, eludiendo el proceso de verificaci\u00f3n previsto. Esta vulnerabilidad ocurre porque el backend no valida correctamente el c\u00f3digo OTP o de respaldo cuando se accede directamente al endpoint de la API '/api/auth/2fa/disable'. Esta falla puede ser explotada por usuarios autenticados para debilitar la seguridad de sus propias cuentas, aunque no conduce a un compromiso total de la cuenta."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74A99A2E-023B-4C39-9696-61DA01C9284E"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}