CVE-2026-82909

Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.

Prior to version 1.0.0-rc.7 in New API, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"). This allows an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs.

In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.

In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.

In New API prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high.

In New API, an LLM gateway and AI asset management system, a vulnerability was found where the email and WeChat account binding endpoints use GET requests for state-changing operations. An attacker can exploit this to hijack a logged-in user's account by tricking their browser into binding an attacker-controlled email or OAuth identity when session cookies are sent on cross-site navigations.

In New API, an LLM gateway and AI asset management system, the default SSRF protection configuration did not apply IP filtering to hostnames. With ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve hostnames to IP addresses, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs pointing to internal or metadata IP addresses.

New API up to version 0.11.9-alpha.1 does not block the address 0.0.0.0 in SSRF protection. A regular user with a valid API token can send requests with 0.0.0.0 as host, bypassing private-IP filters and causing requests to localhost. With AWS/Bedrock Claude adapter, this becomes a full-read SSRF.