CVE-2026-85621

Katalog CVE

CVSS 6.5 · Medium EPSS 0,20%

Kerentanan Insufficient Verification of Data Authenticity. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.

Rincian

Terbit di NVD

4 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/lobehub/lobehub
• https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-feishu/src/adapter.ts
• https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-qq/src/adapter.ts
• https://github.com/lobehub/lobehub/issues/16538
• https://www.vulncheck.com/advisories/lobechat-2.2.1-webhook-signature-verification-bypass-qq-feishu