https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:36:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329673 EUVD-2026-329673 https://cve.radiocsirt.org/vuln/euvd-2026-329673 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54157 <p>LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub&#39;s infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.</p> <p>LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub&#39;s infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54157 https://cve.radiocsirt.org/vuln/ghsa-xmwj-c75x-6346 <p><strong>Affected:</strong> npm: @lobehub/lobehub</p> <p>## Unauthenticated SSRF in /webapi/proxy allows anyone to proxy requests and inject cookies on lobehub.com</p> <p>## Summary</p> <p>The `/webapi/proxy` endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. This is the same proxy code that was vulnerable in CVE-2024-32964, where `/api/proxy` was fixed by adding auth middleware. The `/webapi/proxy` route was never secured — it is the only webapi route missing the `checkAuth()` wrapper. An attacker can use this to make arbitrary outbound requests from LobeHub&#39;s infrastructure, leak Vercel deployment details, and inject cookies on the `lobehub.com` domain through reflected `Set-Cookie` headers.</p> <p>## Vulnerability Details</p> <p>**Type:** Server-Side Request Forgery (CWE-918) **Affected Endpoint:** POST /webapi/proxy **Vulnerable File:** `src/app/(backend)/webapi/proxy/route.ts`</p> <p>The route handler reads a URL from the request body and passes it to `ssrfSafeFetch()` without calling `checkAuth()` first. Every other webapi route (`/webapi/chat/*`, `/webapi/models/*`, `/webapi/create-image/*`) wraps the handler in `checkAuth()`, but the proxy does not. The Next.js middleware also skips `/webapi/` routes — `defaultMiddleware()` calls `NextResponse.next()` for any path starting with `/webapi/`, so neither the route handler nor the middleware performs authentication.</p> <p>## Steps to Reproduce</p> <p>**Fetch an external URL through the proxy (no auth, no cookies, no tokens):**</p> <p>``` curl -X POST -H &#34;Content…</p> <p><strong>Affected:</strong> npm: @lobehub/lobehub</p> <p>## Unauthenticated SSRF in /webapi/proxy allows anyone to proxy requests and inject cookies on lobehub.com</p> <p>## Summary</p> <p>The `/webapi/proxy` endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. This is the same proxy code that was vulnerable in CVE-2024-32964, where `/api/proxy` was fixed by adding auth middleware. The `/webapi/proxy` route was never secured — it is the only webapi route missing the `checkAuth()` wrapper. An attacker can use this to make arbitrary outbound requests from LobeHub&#39;s infrastructure, leak Vercel deployment details, and inject cookies on the `lobehub.com` domain through reflected `Set-Cookie` headers.</p> <p>## Vulnerability Details</p> <p>**Type:** Server-Side Request Forgery (CWE-918) **Affected Endpoint:** POST /webapi/proxy **Vulnerable File:** `src/app/(backend)/webapi/proxy/route.ts`</p> <p>The route handler reads a URL from the request body and passes it to `ssrfSafeFetch()` without calling `checkAuth()` first. Every other webapi route (`/webapi/chat/*`, `/webapi/models/*`, `/webapi/create-image/*`) wraps the handler in `checkAuth()`, but the proxy does not. The Next.js middleware also skips `/webapi/` routes — `defaultMiddleware()` calls `NextResponse.next()` for any path starting with `/webapi/`, so neither the route handler nor the middleware performs authentication.</p> <p>## Steps to Reproduce</p> <p>**Fetch an external URL through the proxy (no auth, no cookies, no tokens):**</p> <p>``` curl -X POST -H &#34;Content…</p> https://cve.radiocsirt.org/vuln/ghsa-xmwj-c75x-6346