LobeChat CVE-2026-85621

For the QQ adapter: the LobeChat instance must have the QQ chat adapter installed and an active QQ bot webhook endpoint exposed to the network; no token or signature configuration is required by the attacker because the adapter performs zero Ed25519 verification unconditionally regardless of any settings. For the Feishu adapter: the adapter must be installed and the webhook endpoint active; exploitation succeeds in the default installation state where no static verification token is configured, which causes the only verification mechanism to be entirely skipped. If an operator has explicitly configured a Feishu static token, the token-mismatch check blocks exploitation via the Feishu path (though this is not a cryptographic body-signature and is not equivalent to full security). In both cases, the attacker must know or enumerate the webhook URL path; CVSS PR:N and UI:N confirm that no authentication and no victim interaction are required. Deployments that have never installed or activated either adapter are entirely unaffected.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) accurately reflects a moderate-severity issue. Attack complexity is low and requires no authentication beyond knowledge of the webhook URL, which is often predictable for known LobeChat deployments. However, the bounded impact - limited confidentiality (bot responses may leak context) and limited integrity (attacker controls bot input) - constrains the base score. The practical risk escalates significantly if the deployed agent is configured to execute tool calls, make API requests, or trigger privileged actions based on inbound messages, as this vulnerability becomes a vector for indirect prompt injection or unauthorized action invocation. KEV status is not listed and no confirmed active exploitation is known; EPSS data is absent. No public exploit code has been identified. The Feishu vector is the more broadly exposed path because the skip-on-default behavior means most Feishu-integrated deployments are vulnerable without any additional attacker preparation; QQ exposure requires the QQ adapter to be installed and active.

An attacker discovers a publicly accessible LobeChat instance by identifying predictable webhook URLs such as /api/agent/webhooks/qq or /api/agent/webhooks/feishu on exposed deployments, then POSTs a crafted JSON payload mimicking a legitimate QQ or Feishu platform event, specifying an arbitrary sender identity and message body. Because the QQ adapter performs no signature check and the Feishu adapter skips token validation in its default unconfigured state, the bot processes the forged payload as a trusted platform message and executes any configured agent logic against the attacker-chosen input. No exploit code is publicly identified, but the attack requires only standard HTTP tooling.