lobe-chat has an Open Redirect

Description

Vulnerability Overview

The project’s OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.130.1
• Patched version(s): 1.130.1

References

• GHSA-xph5-278p-26qx
• CVE-2025-59426
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) - CVE-2024-47066
• Cross-site Scripting in ZenUML - CVE-2024-38527
• Lobe Chat API Key Leak - CVE-2024-37895

Tags:

npm

@lobehub/chat