# CVE-2024-37895: Lobe Chat API key leak via base URL manipulation

Source: https://junglewise.ai/threats/cve-2024-37895-lobe-chat-api-key-leak-via-base-url-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-37895 · Severity: low · CVSS 3.1 · Published 2024-06-17

Lobe Chat is an open-source conversational AI platform. An authenticated attacker can steal backend API credentials by changing the base URL setting to point to an attacker-controlled server and intercepting the API key from request headers. This allows an attacker with valid user credentials to obtain secrets needed to directly access the backend API, potentially enabling unauthorized AI service usage or data exfiltration.

Technologies: [@lobehub/chat (npm)](https://junglewise.ai/threats/technologies/lobehub-chat). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-37895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-37895 being exploited in the wild.

**How severe is CVE-2024-37895?** Low severity, with a CVSS score of 3.1, published 17 June 2024.

**Which products and versions are affected?** @lobehub/chat (npm) SEMVER:introduced=0,fixed=0.162.25.

**Is there a fix for CVE-2024-37895?** Yes. @lobehub/chat (npm): upgrade to 0.162.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-37895 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-37895?** Check whether you run @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @lobehub/chat (npm): upgrade to 0.162.25 or later

  ```sh
  npm install @lobehub/chat@0.162.25
  ```


## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) coupled with credential exposure (CWE-918, CWE-200). Lobe Chat permits authenticated users to modify the backend base URL without validating or restricting outbound destinations. When a user configures a malicious URL and triggers a server-side request, the backend leaks its API key in request headers sent to the attacker's controlled server. The attack requires prior SSO/Access Code authentication and user interaction to change the configuration. No outbound traffic whitelist is implemented. The vulnerability affects all community versions up to 0.162.24; a patch is available in 0.162.25.

## Affected products

- Lobe Hub Lobe Chat <=0.162.24

## Identifiers

- CVE-2024-37895
- GHSA-p36r-qxgx-jq2v

## Timeline

- 2024-06-17: disclosed: GHSA-p36r-qxgx-jq2v published
- 2024-06-17: patched: Fix released in version 0.162.25

## References

- [https://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v](https://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v)

## Related threats

- [LobeHub improper authorization in presigned file upload](https://junglewise.ai/threats/cve-2026-23835-lobehub-improper-authorization-in-presigned-file-upload)
- [Lobe Chat stored XSS in Mermaid artifact renderer escalating to RCE](https://junglewise.ai/threats/cve-2026-23733-lobe-chat-stored-xss-in-mermaid-artifact-renderer-escalating-to)
- [Lobe Chat IDOR in Knowledge Base file removal](https://junglewise.ai/threats/cve-2026-23522-lobe-chat-idor-in-knowledge-base-file-removal)
- [Lobe Chat server-side request forgery in web crawler](https://junglewise.ai/threats/cve-2025-62505-lobe-chat-server-side-request-forgery-in-web-crawler)
- [lobe-chat open redirect via X-Forwarded-Host header](https://junglewise.ai/threats/cve-2025-59426-lobe-chat-open-redirect-via-x-forwarded-host-header)