CVE-2026-64868: high-severity vulnerability in QuantumNous new-api
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
exploitation probability
0.6%top 51% of all CVEs
observed exploitation
nono source reports it
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
QuantumNous · new-apiRelated CVEs — QuantumNous new-api
In the same product, most dangerous first.
CVE-2026-41432HIGHNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudEPSS 0.8%CVE-2026-71479CRITICALNew API: Integer overflow in quota billing yields negative charges (self-crediting)EPSS 0.6%CVE-2026-25591HIGHNew API has an SQL LIKE Wildcard Injection DoS via Token SearchEPSS 0.6%CVE-2026-64859CRITICALNew API: User List API Leaks Root User Access Token Leading to Privilege EscalationEPSS 0.6%CVE-2026-64866MEDIUMNew API: Admin can reset passkeys for same-level or higher-privileged usersEPSS 0.5%CVE-2026-9306MEDIUMQuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorizationEPSS 0.5%