Description
The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes.
Recommendation
Update the @lobehub/lobehub package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.1.47
- Patched version(s): 2.1.48
References
Could your website be exposed too?
SmartScanner can check your website for LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LobeHub: Unauthenticated SSRF in `/webapi/proxy` - CVE-2026-54157
- Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass - CVE-2026-45577
- SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
You might also like:
See something that needs correcting? Let us knowUpdated April 09, 2026