In danny-avila/librechat version 0.7.9, an insecure API design flaw in the 2-Factor Authentication (2FA) flow allows authenticated users to disable 2FA without providing a valid OTP or backup code. This occurs because the backend does not properly validate these codes when the '/api/auth/2fa/disable' endpoint is accessed directly. The vulnerability weakens account security but does not lead to full account compromise.