CVE-2024-37895
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-37895
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-37895.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-37895
- Aliases
- Published
- 2024-06-17T19:28:31.021Z
- Modified
- 2025-11-28T02:34:36.840968Z
- Severity
-
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- API Key Leak in lobe-chat
- Details
-
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37895.json", "cwe_ids": [ "CWE-200" ] }- References