Description

LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:42.293Z",
  "pubdate": "2026-09-04T15:17:42.293Z",
  "executiveSummary": "A critical security vulnerability has been identified in LobeChat (LobeHub) version 2.2.1, specifically involving the improper verification of inbound chat-platform webhook signatures within the QQ and Feishu integration adapters. The application's webhook route, designated as `/api/agent/webhooks/:platform`, is intentionally designed to be unauthenticated, delegating the responsibility of payload verification directly to each platform-specific adapter. Because verification is either omitted or bypassable within the affected adapters, unauthenticated attackers can exploit this behavior to inject forged messages into the system.\nThe risk implications of this flaw are substantial, as it allows remote, unauthenticated attackers who obtain the public webhook URL to bypass security boundaries completely. By crafting and transmitting forged inbound messages with a chosen sender identity and arbitrary text, an attacker can manipulate the bot owner's agent. The agent then processes this malicious, attacker-controlled input while treating the sender as a trusted platform entity. This capability can be leveraged to execute unauthorized actions, trick the agent into performing sensitive operations, or compromise the integrity of interactions between the bot and its legitimate users.",
  "technicalDetails": "The root cause of this vulnerability lies in the decentralized architecture of LobeChat (LobeHub) 2.2.1's webhook processing system. The main entry point, `/api/agent/webhooks/:platform`, does not perform centralized authentication. Instead, it acts as a router that forwards incoming payloads to specific adapter modules, expecting each module to validate the authenticity of the incoming traffic. This design introduces severe security gaps when adapters fail to implement sufficient cryptographic validation.\nIn the QQ adapter, the implementation fails to perform any Ed25519 signature verification on incoming dispatched message events. Under normal circumstances, cryptographic signatures are required to verify that the message originated from the legitimate QQ platform. Without this verification, the QQ adapter accepts any incoming HTTP POST request at face value, treating the payload as a legitimate event.\nIn the Feishu adapter, the security model relies on an optional static-token comparison rather than verifying a cryptographic signature of the request body. This approach is highly flawed for two reasons. First, the static-token comparison is skipped entirely when no token is configured, which is the default setting for the application. Second, even when configured, a static token does not cryptographically bind the request body, meaning it cannot guarantee the integrity of the transmitted data or prevent modification by intermediaries.\nAn attacker can exploit these weaknesses through a straightforward attack flow. First, the attacker discovers the public-facing webhook URL of the target LobeChat instance. Because the endpoint is unauthenticated, no API keys or session credentials are required to interact with it. Next, the attacker constructs a malicious JSON payload formatted to mimic a legitimate event from either QQ or Feishu. Within this payload, the attacker specifies a forged sender identity and inputs arbitrary, potentially malicious text instructions.\nWhen the attacker sends this payload via an HTTP POST request to `/api/agent/webhooks/qq` or `/api/agent/webhooks/feishu`, the LobeChat router forwards the request to the respective adapter. The QQ adapter processes the event immediately without cryptographic checks, while the Feishu adapter skips validation if no token is configured. Consequently, the forged message is parsed, and the bot owner's agent processes the input. The agent executes commands or responds to the text as if it came from a trusted platform sender, allowing the attacker to influence the agent's behavior directly."
}