Read the docs
TI-2026-32309 Aliases CVE-2026-44342GHSA-26v7-h57m-gh9m

New API CSRF in email and WeChat account binding endpoints

Priority LOW 23CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed new-api (QuantumNous): 0.12.0-alpha.1github.com/QuantumNous/new-api (Go): 0.12.0-alpha.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QuantumNousnew-apibefore 0.12.0-alpha.10.12.0-alpha.1Patch availableCNA
—github.com/QuantumNous/new-api (Go)before 0.12.0-alpha.10.12.0-alpha.1Patch availableGHSA-26v7-h57m-gh9m
  • new-api VendorQuantumNous Affected before 0.12.0-alpha.1 Fixed in 0.12.0-alpha.1 Patch available CNA
  • github.com/QuantumNous/new-api (Go) Vendor— Affected before 0.12.0-alpha.1 Fixed in 0.12.0-alpha.1 Patch available GHSA-26v7-h57m-gh9m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*before 0.12.0VulnerableQuantumNous
  • cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·QuantumNous

Remediation

  • Fix · CNA new-api (QuantumNous) Fixed in 0.12.0-alpha.1
  • Fix · GHSA-26v7-h57m-gh9m github.com/QuantumNous/new-api (Go) Fixed in 0.12.0-alpha.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44342
  2. 2026-10-03 Alias added: GHSA-26v7-h57m-gh9m

References

Patch 1

Advisory 1

Other 2

  • TI-2025-35042 QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1HIGH 8.8
  • TI-2026-30643 New API: SSRF Filter Bypass via 0.0.0.0 CVSS 4.0HIGH 7.1
  • TI-2026-30031 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVSS 3.1HIGH 8.2
  • TI-2026-20865 New API has Potential XSS in its MarkdownRenderer component CVSS 3.1HIGH 7.6
  • TI-2026-20698 New API has an SQL LIKE Wildcard Injection DoS via Token Search CVSS 4.0HIGH 7.1
  • TI-2026-23715 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences