High 7.1Published Apr 8, 2026

CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects lobehub. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for lobehub

Exploited in the last 30 days

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness (CWE): CWE-287, CWE-290, CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

lobehub lobehub lobehub:lobehub	before 2.1.48	NVD

References

https://github.com/lobehub/lobehub/commit/3327b293d66c013f076cbc16cdbd05a61a3d0428patch
https://github.com/lobehub/lobehub/pull/13535issue-tracking
https://github.com/lobehub/lobehub/releases/tag/v2.1.48product
https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.