CVE-2026-39411: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39411 is an authentication bypass vulnerability in LobeHub (the @lobehub/lobehub npm package) that allows attackers to forge the X-lobe-chat-auth HTTP header and gain unauthorized access to protected webapi routes. The vulnerability affects all versions up to and including 2.1.47, with version 2.1.48 containing the fix. It was disclosed on April 8, 2026, via a GitHub Security Advisory. The official CVSS v3.1 score assigned by the GitHub Advisory Database is 5.0 (Moderate), though Feedly's estimate rates it 7.1 (High) (Github Advisory, Security Advisory).

The root cause is that the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated using the hardcoded static key LobeHub · LobeHub, which is publicly visible in the repository source code (CWE-287, CWE-290, CWE-345). The backend decodes the XOR payload and treats any decoded JSON with a truthy apiKey field as sufficient authentication — no actual API key validation is performed. Because the XOR key is known, an attacker can craft an arbitrary JSON payload (e.g., {"apiKey":"x"} or {"userId":"victim-user-123","apiKey":"x"}), XOR-encode it with the hardcoded key, and send it as the X-lobe-chat-auth header to bypass authentication. A confirmed PoC header (X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8=) is included in the public advisory (Security Advisory, Github Advisory).

Successful exploitation allows an attacker to access protected webapi routes without a valid session, including POST /webapi/chat/[provider], GET /webapi/models/[provider], POST /webapi/models/[provider]/pull, and POST /webapi/create-image/comfyui. If the deployment has server-side model provider credentials configured (e.g., OPENAI_API_KEY), an attacker can consume those credentials by making unauthorized API calls, leading to financial and operational impact. Additionally, an attacker can impersonate arbitrary users by forging a userId in the payload, enabling access to per-user provider configurations and privileged backend model operations such as chat, model listing, model pulls, and ComfyUI image generation (Security Advisory).

A confirmed public proof-of-concept is included in the GitHub Security Advisory, making this vulnerability trivially exploitable by anyone with network access to a vulnerable LobeHub deployment. The EPSS score is approximately 0.025% (8th percentile), indicating low current exploitation probability, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. No exploit kits or weaponized tooling have been publicly reported (Github Advisory).

1. Reconnaissance: Identify internet-facing LobeHub deployments running @lobehub/lobehub version ≤ 2.1.47 using tools like Shodan or Censys, or by checking the application's version endpoint.
2. Obtain the XOR key: Retrieve the hardcoded XOR key LobeHub · LobeHub from the public LobeHub repository source code (previously in src/envs/auth.ts as SECRET_XOR_KEY).
3. Forge the auth payload: Construct a JSON payload such as {"apiKey":"x"} for basic access, or {"userId":"victim-user-123","apiKey":"x"} for user impersonation. XOR-encode the JSON bytes against the key bytes (cycling the key) and Base64-encode the result. The pre-computed header for {"apiKey":"x"} is: X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8=.
4. Send the forged request: Issue an HTTP request to a protected endpoint with the forged header, for example:

   curl -H 'X-lobe-chat-auth: N00DFSE+B1ngjQI0TR8=' https://<target>/webapi/models/<provider>

5. Achieve unauthorized access: If the deployment has OPENAI_API_KEY or similar credentials configured, the request succeeds and returns provider model listings or allows chat/image generation without any valid login session. For user impersonation, substitute a known userId in the payload to load that user's provider configuration (Security Advisory, Github Advisory).

• Network: Unexpected HTTP requests to /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, or /webapi/create-image/comfyui containing the X-lobe-chat-auth header from unauthenticated or unknown sources; unusual spikes in outbound API calls to model providers (e.g., OpenAI) from the server.
• Logs: Web server access logs showing requests to webapi routes with the X-lobe-chat-auth header but without a corresponding valid session cookie or OIDC token; repeated requests from the same IP to model endpoints without prior authentication flows.
• Application Behavior: Unexpected consumption of server-side API credentials (e.g., sudden increase in OpenAI API usage or billing); model pull operations (/webapi/models/[provider]/pull) or ComfyUI image generation requests initiated without user interaction.

Upgrade to @lobehub/lobehub version 2.1.48 or later, which completely removes the XOR obfuscation authentication mechanism and replaces it with server-validated sessions (Better Auth) and OIDC tokens (Release v2.1.48, Fix PR). The fix removes the apiKey truthiness check as an authentication decision, deletes the XOR utility files (xor-obfuscation.ts, xor.ts), and removes the SECRET_XOR_KEY constant. No configuration-based workaround is available for unpatched versions; immediate upgrade is the only effective remediation. Operators should also audit API provider credential usage logs for signs of unauthorized consumption prior to patching.

The vulnerability was reported by security researcher 13ernkastel and disclosed responsibly through GitHub's private advisory process. The LobeHub maintainer (arvinxx) responded promptly, merging the fix on April 7, 2026, and publishing the advisory on April 8, 2026 — the same day the patched release (v2.1.48) was made available. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (Security Advisory, Fix PR).