CVE-2026-41432
HIGH SEVERITYCVSS Score & Metrics
Base Score
7.1 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Vulnerability Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-345
Source
GitHub
Vendor
go
Product
github.com/QuantumNous/new-api
External References
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
- https://docs.stripe.com/checkout/fulfillment#async-payment-methods
- https://docs.stripe.com/webhooks#verify-official-libraries
- https://github.com/QuantumNous/new-api/releases/tag/v0.12.10
- https://github.com/advisories/GHSA-xff3-5c9p-2mr4
Discussion (0)
Add Comment
No comments yet. Be the first!