CVE-2026-33655

In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.

Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.

Prior to version 1.0.0-rc.7 in New API, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"). This allows an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs.

In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.

In New API prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high.

In New API, an LLM gateway and AI asset management system, a vulnerability was found where the email and WeChat account binding endpoints use GET requests for state-changing operations. An attacker can exploit this to hijack a logged-in user's account by tricking their browser into binding an attacker-controlled email or OAuth identity when session cookies are sent on cross-site navigations.

New API up to version 0.11.9-alpha.1 does not block the address 0.0.0.0 in SSRF protection. A regular user with a valid API token can send requests with 0.0.0.0 as host, bypassing private-IP filters and causing requests to localhost. With AWS/Bedrock Claude adapter, this becomes a full-read SSRF.