Description
Vulnerability Overview
The project’s OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value.
Recommendation
Update the @lobehub/chat package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.130.1
- Patched version(s): 1.130.1
References
Could your website be exposed too?
SmartScanner can check your website for lobe-chat has an Open Redirect and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
- Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module - CVE-2025-62505
- Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion - CVE-2026-23522
- Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
You might also like:
See something that needs correcting? Let us knowUpdated September 26, 2025