CVE-2026-82639: high-severity vulnerability in ChatGPTNextWeb NextChat
NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
ChatGPTNextWeb · NextChatRelated CVEs — ChatGPTNextWeb NextChat
In the same product, most dangerous first.
CVE-2023-49785CRITICALNextChat vulnerable to Server-Side Request Forgery and Cross-site ScriptingEPSS 83.2%CVE-2026-105238MEDIUMChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgeryEPSS 0.4%CVE-2026-7177MEDIUMChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgeryEPSS 0.4%CVE-2026-7178MEDIUMChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgeryEPSS 0.3%CVE-2026-7644MEDIUMChatGPTNextWeb NextChat actions.ts addMcpServer improper authorizationEPSS 0.3%CVE-2026-7643MEDIUMChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyEPSS 0.2%