CVE-2024-37895 - CVE House
Back to Database
Status published Medium CVE-2024-37895

API Key Leak in lobe-chat

Vulnerability Description

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37895

Credits & Attribution

No credits recorded in the NVD database.

References

More from lobehub

View All →
CVE-2025-62505
SSRF in lobehub/lobe-chat with native web fetch module
Low 3
CVE-2025-59426
lobe-chat has an Open Redirect
Medium 4.3
CVE-2025-59417
Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Medium 6.8
CVE-2024-47066
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Critical 9
CVE-2024-32965
ssrf vulnerability in lobe-chat
High 8.1

Affected Vendor

Affected Software

lobe-chat
Vulnerable Versions:
< 0.162.25

Timeline

Official Publish: June 17th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration