CVE-2026-54157

Published Jun 23, 2026

Last updated a month ago

CVSS critical 9.0
LobeHub

Overview

Description
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9
Impact score
6
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-918

Social media

Hype score
Not currently trending

  1. I've earned my first CVE ever, by discovering unauthenticated SSRF at @lobehub. This vulnerability affects all versions up to and including v2.1.56, fixed in 2.1.57. CVE ID: CVE-2026-54157 PoC: https://t.co/N9xo8e1TWZ #bugbounty #cybersecurity #bugbountytips #CVE

    @0xj3st3r

    15 Jun 2026

    3512 Impressions

    11 Retweets

    95 Likes

    41 Bookmarks

    4 Replies

    0 Quotes

References

Sources include official advisories and independent security research.