CVE-2026-54157
Critical · 9.0CVSS
9.0
EPSS
1.8%
Published
Jun 23, 2026
CISA due date
—
The record
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/lobehub | 0 | 2.1.57 |
Related vulnerabilities
- GHSA-xmwj-c75x-6346 LobeHub: Unauthenticated SSRF in `/webapi/proxy` Same vulnerability
- CVE-2026-42045 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-xq4x-622m-q8fq LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution Also affects @lobehub/lobehub
- CVE-2026-39411 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-5mwj-v5jw-5c97 LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable… Also affects @lobehub/lobehub
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918