CVE-2026-54157Disclosure

LOWCVSS 9.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-06-15); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

j3st3r@0xj3st3r139d
Disclosure
I've earned my first CVE ever, by discovering unauthenticated SSRF at @lobehub. This vulnerability affects all versions up to and including v2.1.56, fixed in 2.1.57. CVE ID: CVE-2026-54157 PoC: https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346 #bugbounty #cybersecurity #bugbountytips #CVE
Post summary
A new CVE (CVE-2026-54157) was disclosed for lobehub, describing an unauthenticated SSRF across all versions up to v2.1.56, with a PoC link provided and a fix available in v2.1.57.
5170127515.5K
197 followersView on X
Joey Romaine 🇺🇸 |=★=|@Tank23x0116d
Disclosure
CVSS 9.0. CVE-2026-54157. Worth reading before your users find out the hard way. LobeHub: Unauthenticated SSRF in `/webapi/proxy` New week. Sharper than the last.
Post summary
The tweet announces a critical unauthenticated SSRF vulnerability (CVE-2026-54157) in LobeHub’s `/webapi/proxy`, noting a CVSS 9.0 score and urging users to be aware before exploitation occurs.
0000057
336 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds131d
Disclosure
CVE-2026-54157 Server-Side Request Forgery in LobeHub Prior to Version 2.1.57 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54157
Post summary
The text announces a Server‑Side Request Forgery vulnerability (CVE‑2026‑54157) in LobeHub before version 2.1.57, but offers no exploitation proof, tool, active usage claim, patch, or false‑positive notice.
00000105
4.1K followersView on X

Explore more

Back to dashboard