CVE-2026-44342
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In New API, an LLM gateway and AI asset management system, a vulnerability was found where the email and WeChat account binding endpoints use GET requests for state-changing operations. An attacker can exploit this to hijack a logged-in user's account by tricking their browser into binding an attacker-controlled email or OAuth identity when session cookies are sent on cross-site navigations.
Risk Assessment
The risk involves potential account takeover by an attacker, leading to unauthorized access to sensitive data and AI system functions, including language models and asset management.
Recommendation
Immediately update New API to version 0.12.0-alpha.1 or later, which includes a fix for this vulnerability. Additionally, implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in New API
See all- CVE-2026-64868High
In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.
- CVE-2026-71479Critical
Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.
- CVE-2026-64859Critical
Prior to version 1.0.0-rc.7 in New API, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"). This allows an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs.
- CVE-2026-64866Medium
In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.
- CVE-2026-64865Medium
In New API prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high.
- CVE-2026-33655High
In New API, an LLM gateway and AI asset management system, the default SSRF protection configuration did not apply IP filtering to hostnames. With ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve hostnames to IP addresses, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs pointing to internal or metadata IP addresses.
- CVE-2026-42339High
New API up to version 0.11.9-alpha.1 does not block the address 0.0.0.0 in SSRF protection. A regular user with a valid API token can send requests with 0.0.0.0 as host, bypassing private-IP filters and causing requests to localhost. With AWS/Bedrock Claude adapter, this becomes a full-read SSRF.
Original NVD description (English source)
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.