GHSA-5mwj-v5jw-5c97
Medium · 5.0CVSS
5.0
EPSS
—
Published
Apr 8, 2026
CISA due date
—
The record
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/lobehub | 0 | 2.1.48 |
Related vulnerabilities
- CVE-2026-39411 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Same vulnerability
- CVE-2026-54157 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-xmwj-c75x-6346 LobeHub: Unauthenticated SSRF in `/webapi/proxy` Also affects @lobehub/lobehub
- CVE-2026-42045 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-xq4x-622m-q8fq LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution Also affects @lobehub/lobehub
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287