{"id":"EUVD-2025-31072","enisaUuid":"dc09d126-f661-3194-ac5d-a9f6b054b32a","description":"Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project\u0027s OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain. This issue has been patched in version 1.130.1.","datePublished":"Sep 25, 2025, 2:00:09 PM","dateUpdated":"Sep 25, 2025, 2:18:27 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx\nhttps://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445\nhttps://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127\n","aliases":"CVE-2025-59426\nGHSA-xph5-278p-26qx\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"d4db4f83-a940-35ce-b94b-ed69199fc543","product":{"name":"lobe-chat","vendor":{"name":"lobehub"}},"product_version":"\u003c 1.130.1"}],"enisaIdVendor":[{"id":"1864c8ba-f880-3d89-accf-44cab2058af7","vendor":{"name":"lobehub"}}],"enisaIdVulnerability":[{"id":"dabe7d28-ecb6-3420-8c3e-93a8ef8cec2e","vulnerability":{"id":"CVE-2025-59426","description":"Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project\u0027s OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain. This issue has been patched in version 1.130.1.","datePublished":"Sep 25, 2025, 2:00:09 PM","dateUpdated":"Sep 25, 2025, 2:18:27 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx\nhttps://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445\nhttps://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127\n","enisa_id":"EUVD-2025-31072\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 2, 2026, 7:14:43 AM","vulnerabilityProduct":[{"id":"a53d4dea-4f23-32cc-a78c-6311c86fe7c1","product":{"name":"lobe-chat","vendor":{"name":"lobehub"}},"product_version":"\u003c 1.130.1"},{"id":"ee576fa6-6a84-41f9-ab24-333af6c040d8","product":{"name":"lobe-chat","vendor":{"name":"lobehub"}},"product_version":"\u003c 1.130.1"}],"vulnerabilityVendor":[{"id":"3a18e636-95c1-3e13-a1aa-4eb2a2f080bc","vendor":{"name":"lobehub"}}]}},{"id":"ec601fc6-8cdc-3bae-925b-80a0ffd71ea4","vulnerability":{"id":"GHSA-xph5-278p-26qx","description":"lobe-chat has an Open Redirect","datePublished":"Sep 24, 2025, 9:34:10 PM","dateUpdated":"Oct 13, 2025, 3:56:03 PM","baseScore":0.0,"references":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59426\nhttps://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445\nhttps://github.com/lobehub/lobe-chat\nhttps://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127\n","enisa_id":"EUVD-2025-31072\n","aliases":"CVE-2025-59426\nGHSA-xph5-278p-26qx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}