CVE-2025-8850: 
NixOS vulnerability analysis and mitigation

CVE-2025-8850 is an insecure API design vulnerability in the 2-Factor Authentication (2FA) flow of LibreChat version 0.7.9. It allows authenticated users to disable 2FA on their accounts without providing a valid OTP or backup code by directly calling the /api/auth/2fa/disable API endpoint. The vulnerability was published on October 30, 2025, and affects LibreChat versions up to and including 0.7.9 (prior to v0.8.0-rc2). It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Huntr Bounty).

The root cause is classified as CWE-440 (Expected Behavior Violation): the backend disable2FA handler in api/server/controllers/TwoFactorController.js did not validate the presence or correctness of a TOTP token or backup code before clearing the user's totpSecret, backupCodes, and twoFactorEnabled fields. An authenticated attacker could send a direct HTTP POST request to /api/auth/2fa/disable without supplying any OTP or backup code, and the server would unconditionally disable 2FA for the account. The fix, introduced in commit 7e4c8a5, adds a verification gate: if twoFactorEnabled is true, the endpoint now requires either a valid TOTP token or a valid backup code before proceeding (GitHub Commit, Huntr Bounty).

An authenticated attacker (or a malicious user acting on their own account) can silently remove the 2FA protection from a LibreChat account, reducing it to single-factor authentication and making it significantly easier for subsequent credential-based attacks (e.g., phishing, credential stuffing) to succeed. While the vulnerability does not directly grant access to other accounts or lead to immediate full account compromise, it degrades the security posture of affected accounts and could serve as a preparatory step for further unauthorized access. The CVSS score of 8.8 reflects high potential impacts on confidentiality, integrity, and availability if the weakened account is subsequently compromised (Huntr Bounty, Red Hat CVE).

1. Authentication: Log in to a LibreChat instance (version 0.7.9 or earlier) with valid credentials for the target account — the attacker must be authenticated.
2. Identify the endpoint: Locate the 2FA disable API endpoint at /api/auth/2fa/disable.
3. Send unauthenticated disable request: Issue a direct HTTP POST request to /api/auth/2fa/disable using the authenticated session token, with an empty or omitted request body (no token or backupCode fields).
4. Observe result: The server, lacking OTP validation logic in the vulnerable version, processes the request and clears totpSecret, backupCodes, and sets twoFactorEnabled to false for the account.
5. Account weakened: The account now relies solely on password authentication, making it susceptible to credential-based attacks without triggering 2FA challenges (Huntr Bounty, GitHub Commit).

• Network: Unexpected HTTP POST requests to /api/auth/2fa/disable with an empty or missing request body (no token or backupCode fields), particularly outside of normal user activity hours.
• Logs: Application logs showing successful 2FA disable operations (HTTP 200 responses from /api/auth/2fa/disable) without a preceding OTP verification step or without corresponding user-initiated UI actions.
• Application State: User accounts where twoFactorEnabled transitions from true to false and totpSecret is cleared without a corresponding support ticket or user-reported action — especially if the change was not initiated through the standard UI flow.

Update LibreChat to a version after 0.7.9 (v0.8.0-rc2 or later), which includes the patch in commit 7e4c8a5 that enforces OTP or backup code verification before allowing 2FA to be disabled. There is no documented configuration-based workaround for the vulnerable version; upgrading is the only reliable remediation. Additionally, administrators should audit logs for unexpected 2FA disable events and consider implementing monitoring alerts for 2FA configuration changes (GitHub Commit, Huntr Bounty).

The vulnerability was reported through the Huntr bug bounty platform and assigned a CVE by the NVD. Red Hat has also tracked the advisory. No notable public researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation (Red Hat CVE, Huntr Bounty).