by Kastro
Paper/Archive/CVE-2026-54157

CVE-2026-54157

lobehub lobehub — LobeHub: Unauthenticated SSRF in `/webapi/proxy`

EPSS 2%public exploitCVSS 9.0
critical.is priorityof 100
53
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 78.9.789 × 2015.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.

Affected

ProductAffectedFixed inSource
lobehub< 2.1.57–CNA

Scores by source

GitHub_M (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346