Insecure API Design in LibreChat Affects User Authentication Security

CVE-2025-8850

What is CVE-2025-8850?

In version 0.7.9 of LibreChat developed by danny-avila, a flaw in the API allows users to disable 2-Factor Authentication (2FA) without providing a valid one-time password (OTP) or backup code. This design oversight permits authenticated users to bypass critical security measures, thereby undermining the integrity of their accounts. The vulnerability arises from the backend's failure to validate authentication inputs on the '/api/auth/2fa/disable' endpoint effectively. While this does not grant full account access to unauthorized actors, it significantly weakens account security for users who may unknowingly expose themselves to risk.

References