CVE-2025-59426: lobe-chat has an Open Redirect

(updated )

  • It can force users to redirect to untrusted external domains, leading to subsequent attacks such as phishing, credential harvesting, and session fixation.
  • It can disrupt the OAuth/OIDC flow user experience by redirecting users to malicious domains disguised as legitimate pages (even though this path doesn’t directly include tokens, it can be exploited for social engineering attacks through redirect chains).
  • The impact can be amplified when redirect chains are combined with other vulnerabilities such as CSP bypass or cache poisoning.

References

Code Behaviors & Features

Detect and mitigate CVE-2025-59426 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →