PT-2025-39385 · Lobe Chat · Lobe Chat

Im-Soohyun · Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-59426

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 1.130.1

Description Lobe Chat, an open-source artificial intelligence chat framework, has an issue in its OIDC redirect handling logic. The logic builds the redirect URL’s host and protocol using the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. If a reverse proxy forwards client-supplied X-Forwarded-* headers without validation, or if the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect to a malicious domain.

Recommendations Update to Lobe Chat version 1.130.1 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-59426

GHSA-XPH5-278P-26QX

Affected Products

Lobe Chat

References · 12

• 🔥 https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59426.json · Exploit
• https://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59426 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xph5-278p-26qx · Vendor Advisory
• https://github.com/lobehub/lobe-chat · Note
• https://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127 · Note
• https://t.me/CVEtracker/33316 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971233161569780148 · Twitter Post
• https://twitter.com/CVEnew/status/1971217154369290438 · Twitter Post
• https://t.me/cveNotify/136400 · Telegram Post