CVE-2026-39411

The record

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.

Affected packages

Related vulnerabilities

• GHSA-5mwj-v5jw-5c97 LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable… Same vulnerability
• CVE-2026-54157 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
• GHSA-xmwj-c75x-6346 LobeHub: Unauthenticated SSRF in `/webapi/proxy` Also affects @lobehub/lobehub
• CVE-2026-42045 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
• GHSA-xq4x-622m-q8fq LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution Also affects @lobehub/lobehub
• CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
• CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287