Executive brief
LobeHub's LobeChat AI agent platform accepts inbound messages from chat services (QQ and Feishu) via an unauthenticated webhook endpoint. An attacker can forge messages from these services without authentication, causing the bot to process and act on fabricated instructions as if they came from trusted platforms. This allows unauthorized manipulation of deployed AI agents.
Technical details
The vulnerability is an authentication bypass in the webhook handlers for QQ and Feishu chat platform adapters. The webhook route (/api/agent/webhooks/:platform) deliberately omits authentication and delegates verification to adapter-specific code. The QQ adapter performs no Ed25519 signature verification on message events, and the Feishu adapter only performs an optional static-token comparison that defaults to disabled and does not validate message body signatures. An unauthenticated attacker with network access to the webhook URL can POST forged messages with arbitrary sender identity and content, which the bot will process as legitimate platform events. No authentication is required and the attack is network-accessible.
Affected products
- LobeHub LobeChat 2.2.1
Timeline
- 2026-09-04: disclosed