CVE-2025-62155: falha de alta gravidade em QuantumNous new-api
QuantumNous New API Has SSRF Bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.3%
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.
Because the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
QuantumNous · new-apiCVEs relacionadas — QuantumNous new-api
No mesmo produto, das mais perigosas para as menos.
CVE-2026-41432HIGHNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudEPSS 0.9%CVE-2026-71479CRITICALNew API: Integer overflow in quota billing yields negative charges (self-crediting)EPSS 0.6%CVE-2026-64868HIGHNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingEPSS 0.6%CVE-2026-64859CRITICALNew API: User List API Leaks Root User Access Token Leading to Privilege EscalationEPSS 0.6%CVE-2026-25591HIGHNew API has an SQL LIKE Wildcard Injection DoS via Token SearchEPSS 0.6%CVE-2026-64866MEDIUMNew API: Admin can reset passkeys for same-level or higher-privileged usersEPSS 0.5%