CVE-2026-39411: LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
(updated )
The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes.
Affected routes include:
POST /webapi/chat/[provider]GET /webapi/models/[provider]POST /webapi/models/[provider]/pullPOST /webapi/create-image/comfyui
References
- github.com/advisories/GHSA-5mwj-v5jw-5c97
- github.com/lobehub/lobehub
- github.com/lobehub/lobehub/commit/3327b293d66c013f076cbc16cdbd05a61a3d0428
- github.com/lobehub/lobehub/pull/13535
- github.com/lobehub/lobehub/releases/tag/v2.1.48
- github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97
- nvd.nist.gov/vuln/detail/CVE-2026-39411
Code Behaviors & Features
Detect and mitigate CVE-2026-39411 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →