lobe-chat has an Open Redirect

Description

Vulnerability Overview

The project’s OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.130.1
• Patched version(s): 1.130.1

References

• GHSA-xph5-278p-26qx
• CVE-2025-59426
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion - CVE-2026-23522
• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module - CVE-2025-62505
• Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733

Tags:

npm

@lobehub/chat