CVE-2026-41432: falha de alta gravidade em QuantumNous new-api
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7.1epss 0.9%
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
QuantumNous · new-apiCVEs relacionadas — QuantumNous new-api
No mesmo produto, das mais perigosas para as menos.
CVE-2026-71479CRITICALNew API: Integer overflow in quota billing yields negative charges (self-crediting)EPSS 0.6%CVE-2026-64868HIGHNew API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingEPSS 0.6%CVE-2026-64859CRITICALNew API: User List API Leaks Root User Access Token Leading to Privilege EscalationEPSS 0.6%CVE-2026-25591HIGHNew API has an SQL LIKE Wildcard Injection DoS via Token SearchEPSS 0.6%CVE-2026-64866MEDIUMNew API: Admin can reset passkeys for same-level or higher-privileged usersEPSS 0.5%CVE-2026-33655HIGHNew API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsEPSS 0.4%