CVE-2026-85621LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu
Updated under an hour ago ()
Does this affect you?
It affects lobehub. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-345
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Sep 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
lobehub lobehub lobehub:lobehub (from the name) | through 2.2.15 | CNA record |
References
- https://github.com/lobehub/lobehub/issues/16538issue-tracking
- https://github.com/lobehub/lobehubproduct
- https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-qq/src/adapter.tstechnical-description
- https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-feishu/src/adapter.tstechnical-description
- https://www.vulncheck.com/advisories/lobechat-2.2.1-webhook-signature-verification-bypass-qq-feishuthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.