Webhook Signature Verification Bypass in LobeChat by LobeHub
CVE-2026-85621

6.9MEDIUM

Key Information:

Vendor

Lobehub

Status
Lobehub
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85621?

LobeChat version 2.2.1 is vulnerable due to its failure to properly authenticate incoming webhook signatures for the QQ and Feishu adapters. The insecure design of the webhook route (/api/agent/webhooks/:platform) allows unauthorized access, as it lacks proper authentication checks. The QQ adapter does not verify Ed25519 signatures on received messages, while the Feishu adapter only offers an optional static-token comparison that is not enforced unless a token is set, which defaults to empty. This oversight makes it possible for attackers to exploit this vulnerability by sending crafted messages from arbitrary sender identities, leading to potential misuse of the bot owner’s agent capable of processing unverified input.

Affected Version(s)

lobehub 0 <= 2.2.15

References

https://github.com/lobehub/lobehub/issues/16538
issue-tracking
https://github.com/lobehub/lobehub
product
https://github.com/lobehub/lobehub/blob/v2.2.15/packages/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.