New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Priority HIGH 69CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0085 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed new-api (QuantumNous): 0.12.10github.com/QuantumNous/new-api (Go): 0.12.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QuantumNous | new-api | before 0.12.10 | 0.12.10 | Patch available | CNA |
| — | github.com/QuantumNous/new-api (Go) | before 0.12.10 | 0.12.10 | Patch available | GHSA-xff3-5c9p-2mr4 |
- new-api VendorQuantumNous Affected before 0.12.10 Fixed in 0.12.10 Patch available CNA
- github.com/QuantumNous/new-api (Go) Vendor— Affected before 0.12.10 Fixed in 0.12.10 Patch available GHSA-xff3-5c9p-2mr4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* | before 0.12.10 | Vulnerable | QuantumNous |
- cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* Versions before 0.12.10 Vulnerable ·QuantumNous
Remediation
- Fix · CNA new-api (QuantumNous) Fixed in 0.12.10
- Fix · GHSA-xff3-5c9p-2mr4 github.com/QuantumNous/new-api (Go) Fixed in 0.12.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41432
- 2026-10-03 Alias added: GHSA-xff3-5c9p-2mr4
References
More QuantumNous New Api vulnerabilities
- TI-2025-35042 QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1HIGH 8.8
- TI-2026-30643 New API: SSRF Filter Bypass via 0.0.0.0 CVSS 4.0HIGH 7.1
- TI-2026-20865 New API has Potential XSS in its MarkdownRenderer component CVSS 3.1HIGH 7.6
- TI-2026-20698 New API has an SQL LIKE Wildcard Injection DoS via Token Search CVSS 4.0HIGH 7.1
- TI-2026-23715 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVSS 3.1MEDIUM 6.5
- TI-2026-26035 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVSS 3.1HIGH 7.7
Sources
- CVE-2026-41432 · CVE Program
- CVE-2026-41432 · NVD
- FIRST EPSS
- GHSA-xff3-5c9p-2mr4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences