EUVD-2026-290132

fkie_cve-2026-39411

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.

GHSA-5mwj-v5jw-5c97 — LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

Affected: npm: @lobehub/lobehub

# Summary

The `webapi` authentication layer trusts a client-controlled `X-lobe-chat-auth` header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected `webapi` routes.

Affected routes include: - `POST /webapi/chat/[provider]` - `GET /webapi/models/[provider]` - `POST /webapi/models/[provider]/pull` - `POST /webapi/create-image/comfyui`

## Details

The frontend creates `X-lobe-chat-auth` by XOR-obfuscating JSON with the static key `LobeHub · LobeHub`, and the backend reverses that operation and treats the decoded JSON as trusted authentication data.

The backend then accepts any truthy `apiKey` field in that decoded payload as sufficient authentication. No real API key validation is performed in this path.

As a result, an unauthenticated attacker can forge payloads such as:

```json {"apiKey":"x"} ```

``` {"userId":"victim-user-123","apiKey":"x"} ```

and access webapi routes as an authenticated user.

Confirmed PoC The following forged header was generated directly from the published XOR key using payload {"apiKey":"x"}:

``` X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8= ```

That header decodes server-side to:

``` {"apiKey":"x"}```

A simple request is:

``` curl 'https://TARGET/webapi/models/openai' \ -H 'X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8=' ```

If the deployment has OPENAI_API_KEY configured, the request should…

Most recent entries from all

EUVD-2026-290132

fkie_cve-2026-39411

GHSA-5mwj-v5jw-5c97 — LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header