{"id":"EUVD-2025-31072","revision":"1148cbe32d8645199f908cc2e2a66dd5","records":[{"revision":"1148cbe32d8645199f908cc2e2a66dd5","observedAt":"2026-10-29T23:57:49.014+00:00","statement":{"source":"euvd","id":"EUVD-2025-31072","aliases":["CVE-2025-59426","GHSA-xph5-278p-26qx"],"title":"Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host header…","description":"Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain. This issue has been patched in version 1.130.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3,"severity":null}],"references":["https://github.com/lobehub/lobe-chat/security/advisories/GHSA-xph5-278p-26qx","https://github.com/lobehub/lobe-chat/commit/70f52a3c1fadbd41a9db0e699d1e44d9965de445","https://github.com/lobehub/lobe-chat/blob/aa841a3879c30142720485182ad62aa0dbd74edc/src/app/(backend)/oidc/consent/route.ts#L113-L127"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31072","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 25, 2025, 2:00:09 PM","dateUpdated":"Sep 25, 2025, 2:18:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-31072","identifiers":["EUVD-2025-31072","CVE-2025-59426","GHSA-xph5-278p-26qx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}