CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Attackers can bypass authentication on protected webapi routes by forging the X-lobe-chat-auth header using a hardcoded XOR key.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39411?
CVE-2026-39411 is a medium-severity authentication bypass vulnerability in lobehub, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.
Which versions are affected by CVE-2026-39411?
2 open source packages ship an affected version, including @lobehub/lobehub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@lobehub/lobehub npm | All versions | 2.1.48 |
@lobehub/lobehub npm | All versions | 2.1.48 |
Products include Lobehub Lobehub.
How do I fix CVE-2026-39411?
Upgrade @lobehub/lobehub to 2.1.48 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-39411 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39411 exists.
Sources
Also known as GHSA-5mwj-v5jw-5c97.