# CVE-2026-85621: LobeHub LobeChat webhook signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-85621-lobehub-lobechat-webhook-signature-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85621 · Severity: medium · CVSS 6.5 · Published 2026-09-04

LobeHub's LobeChat AI agent platform accepts inbound messages from chat services (QQ and Feishu) via an unauthenticated webhook endpoint. An attacker can forge messages from these services without authentication, causing the bot to process and act on fabricated instructions as if they came from trusted platforms. This allows unauthorized manipulation of deployed AI agents.

Technologies: [LobeHub LobeChat](https://junglewise.ai/threats/technologies/lobechat). Vendors: [LobeHub](https://junglewise.ai/threats/vendors/lobehub).

## Quick answers

**Is CVE-2026-85621 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85621 being exploited in the wild.

**How severe is CVE-2026-85621?** Medium severity, with a CVSS score of 6.5, published 4 September 2026.

**Which products and versions are affected?** LobeHub LobeChat 2.2.1.

**Is there a fix for CVE-2026-85621?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85621 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85621?** Check whether you run LobeHub LobeChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the webhook handlers for QQ and Feishu chat platform adapters. The webhook route (/api/agent/webhooks/:platform) deliberately omits authentication and delegates verification to adapter-specific code. The QQ adapter performs no Ed25519 signature verification on message events, and the Feishu adapter only performs an optional static-token comparison that defaults to disabled and does not validate message body signatures. An unauthenticated attacker with network access to the webhook URL can POST forged messages with arbitrary sender identity and content, which the bot will process as legitimate platform events. No authentication is required and the attack is network-accessible.

## Affected products

- LobeHub LobeChat 2.2.1

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/lobehub/lobehub](https://github.com/lobehub/lobehub)
- [https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-feishu/src/adapter.ts](https://github.com/lobehub/lobehub/blob/v2.2.15/packages/chat-adapter-feishu/src/adapter.ts)

## Related threats

- [LobeChat stored XSS in user avatar upload](https://junglewise.ai/threats/cve-2026-72594-lobechat-stored-xss-in-user-avatar-upload)
- [LobeHub LobeChat broken object level authorization in chat-group agents](https://junglewise.ai/threats/cve-2026-59100-lobehub-lobechat-broken-object-level-authorization-in-chat-group)
- [LobeHub LobeChat broken access control in RAG semantic search](https://junglewise.ai/threats/cve-2026-59098-lobehub-lobechat-broken-access-control-in-rag-semantic-search)
- [LobeHub LobeChat SSRF in skill import and topic cover endpoints](https://junglewise.ai/threats/cve-2026-59095-lobehub-lobechat-ssrf-in-skill-import-and-topic-cover-endpoints)
- [LobeHub LobeChat broken object-level authorization in MessageModel](https://junglewise.ai/threats/cve-2026-58580-lobehub-lobechat-broken-object-level-authorization-in)