https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:02:35 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07878 bdu:2026-07878 https://cve.radiocsirt.org/vuln/bdu:2026-07878 https://cve.radiocsirt.org/vuln/euvd-2026-260173 EUVD-2026-260173 https://cve.radiocsirt.org/vuln/euvd-2026-260173 https://cve.radiocsirt.org/vuln/fkie_cve-2025-8850 <p>In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint &#39;/api/auth/2fa/disable&#39; is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.</p> <p>In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint &#39;/api/auth/2fa/disable&#39; is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-8850 https://cve.radiocsirt.org/vuln/ghsa-x5w7-gch7-xjf6 <p>In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint &#39;/api/auth/2fa/disable&#39; is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.</p> <p>In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint &#39;/api/auth/2fa/disable&#39; is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.</p> https://cve.radiocsirt.org/vuln/ghsa-x5w7-gch7-xjf6