CVE-2026-71479
CriticalCVSS 9.1Summary
Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.
Risk Assessment
The organization may suffer financial losses as an attacker can manipulate billing to generate credits and drain funds.
Recommendation
Update New API to version 1.0.0-rc.18 or later, which includes the fix.
Original NVD description (English source)
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.