LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Date: 2026-04
Affected: npm/@lobehub/lobehub
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-39411
CWE: CWE-287
CWE-290
CWE-345
CVSS: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

# Summary The `webapi` authentication layer trusts a client-controlled `X-lobe-chat-auth` header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected `webapi` routes. Affected routes include: - `POST /webapi/chat/[provider]` - `GET /webapi/models/[provider]` - `POST /webapi/models/[provider]/pull` - `POST /webapi/create-image/comfyui` ## Details The frontend creates `X-lobe-chat-auth` by XOR-obfuscating JSON with the static key `LobeHub · LobeHub`, and the backend reverses that operation and treats the decoded JSON as trusted authentication data. The backend then accepts any truthy `apiKey` field in that decoded payload as sufficient authentication. No real API key validation is performed in this path. As a result, an unauthenticated attacker can forge payloads such as: ```json {"apiKey":"x"} ``` or ``` {"userId":"victim-user-123","apiKey":"x"} ``` and access webapi routes as an authenticated user. Confirmed PoC The following forged header was generated directly from the published XOR key using payload {"apiKey":"x"}: ``` X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8= ``` That header decodes server-side to: ``` {"apiKey":"x"}``` A simple request is: ``` curl 'https://TARGET/webapi/models/openai' \ -H 'X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8=' ``` If the deployment has OPENAI_API_KEY configured, the request should


Mitigations:

Architectural layers (MAESTRO):