EUVD-2026-71228
GHSA-627w-x4jq-g83v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint; low complexity with no special conditions; limited integrity and confidentiality impact from forged message injection, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.
AnalysisAI
Webhook signature verification bypass in LobeChat 2.2.1 allows unauthenticated remote attackers to inject forged inbound messages into bot conversations by exploiting missing or skippable signature checks in the QQ and Feishu platform adapters. The QQ adapter performs no Ed25519 verification whatsoever, while the Feishu adapter's static-token check is entirely skipped in default deployments where no token is configured. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | For the QQ adapter: the LobeChat instance must have the QQ chat adapter installed and an active QQ bot webhook endpoint exposed to the network; no token or signature configuration is required by the attacker because the adapter performs zero Ed25519 verification unconditionally regardless of any settings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) accurately reflects a moderate-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LobeChat to a version in which the QQ adapter implements Ed25519 signature verification and the Feishu adapter enforces body-signature validation unconditionally. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Lobe Chat is an open-source artificial intelligence chat framework. Rated high severity (CVSS 8.8), this vulnerability i
Lobe Chat is an open-source, AI chat framework. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab
Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing
Denial of service in LobeChat before 2.2.10-canary.15 lets an authenticated user hang the entire Node.js server by impor
Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' document
Lobe Chat is an open-source LLMs/AI chat framework. Rated medium severity (CVSS 5.7), this vulnerability is remotely exp
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScri
Broken object level authorization in LobeChat through version 2.2.9 permits authenticated users to read and manipulate c
Broken object-level authorization in LobeChat server-database deployments through version 2.2.9 enables any authenticate
Lobe Chat is an open-source artificial intelligence chat framework. Rated medium severity (CVSS 4.3), this vulnerability
Share
External POC / Exploit Code
Leaving vuln.today