LobeHub: Contournement d'authentification non authentifié sur les routes `webapi` via un en-tête `X-lobe-chat-auth` falsifiable

The core of this vulnerability lies in the inadequate authentication of the X-lobe-chat-auth header. This header is intended to authenticate requests to the webapi layer, but the implementation relies on a simple XOR obfuscation using a hardcoded key. Because the key is publicly available within the repository, attackers can easily calculate the XOR value for arbitrary JSON payloads, effectively forging valid authentication tokens. This allows them to bypass authentication and access protected routes, including POST /webapi/chat/[provider], GET /webapi/models/[provider], POST /webapi/models/[provider]/pull, and POST /webapi/create-image/comfyui. Successful exploitation could lead to unauthorized access to model data, chat logs, and the ability to trigger image creation processes, potentially impacting data confidentiality and integrity.

Applications and services utilizing the @lobehub/lobehub library in their authentication flow are at risk. This includes projects that rely on the library for managing chat interactions, model access, and image creation. Shared hosting environments where multiple applications share the same @lobehub/lobehub installation are particularly vulnerable, as a compromise in one application could potentially affect others.

• nodejs / server:

  npm list @lobehub/lobehub

• nodejs / server:

  npm audit @lobehub/lobehub

• generic web: Inspect HTTP requests for the X-lobe-chat-auth header. Look for unusual or unexpected values. Check access logs for requests to /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui with potentially forged authentication headers.

1. 2026-04-08Disclosure

   disclosure

1. Réservé2026-04-07
2. Publiée2026-04-08
3. Modifiée2026-04-09
4. EPSS mis à jour2026-04-16

The primary mitigation for CVE-2026-39411 is to upgrade to version 2.1.48 or later of the @lobehub/lobehub library. This version incorporates a more robust authentication mechanism that eliminates the reliance on the vulnerable XOR obfuscation. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests with suspicious X-lobe-chat-auth headers. Specifically, look for headers containing unusual characters or patterns that deviate from expected values. Additionally, review and restrict access to the affected webapi endpoints to minimize the potential impact of a successful attack. After upgrading, confirm the fix by attempting to access protected webapi routes with a forged X-lobe-chat-auth header – the request should be rejected.