CVE-2026-39411

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes. Affected routes include /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui. This vulnerability is fixed in 2.1.48.

• CWE-287
• CWE-290
• CWE-345

• https://github.com/lobehub/lobehub/commit/3327b293d66c013f076cbc16cdbd05a61a3d0428Patch
• https://github.com/lobehub/lobehub/pull/13535Issue Tracking
• https://github.com/lobehub/lobehub/releases/tag/v2.1.48Product
• https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97Vendor Advisory
• https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39406@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-39409Hono is a Web application framework that provides support fo…5.3
• CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
• CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
• CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5
• CVE-2026-39415Frappe Learning Management System (LMS) is a learning system…4.3
• CVE-2026-39416AIL framework is an open-source platform to collect, crawl, …6.1
• CVE-2026-39417MaxKB is an open-source AI assistant for enterprise. Version…5.5