CVE-2026-39411
CVE-2026-39411 · LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.
CVSS 5.0 · Mittel · EPSS 0,1% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
lobehub
- Softwareversionen
- < 2.1.48: Betroffen
Keine Korrektur veröffentlicht
@lobehub/lobehub npm
- Betroffene Versionsbereiche
- SEMVER: < 2.1.48
Auf 2.1.48 aktualisieren
Originalquellen
- https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97
- https://github.com/lobehub/lobehub/pull/13535
- https://github.com/lobehub/lobehub/commit/3327b293d66c013f076cbc16cdbd05a61a3d0428
- https://github.com/lobehub/lobehub/releases/tag/v2.1.48
- https://nvd.nist.gov/vuln/detail/CVE-2026-39411