CVE-2026-7643: falha de média gravidade em ChatGPTNextWeb NextChat
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.2%
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
ChatGPTNextWeb · NextChatPoCs públicas encontradas — 1
cve_referencegithub.com/ChatGPTNextWeb/NextChat/issues/6756não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — ChatGPTNextWeb NextChat
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49785CRITICALNextChat vulnerable to Server-Side Request Forgery and Cross-site ScriptingEPSS 83.2%CVE-2026-82639HIGHNextChat 2.15.8 through 2.16.1 OpenAI API Key DisclosureEPSS 0.5%CVE-2026-105238MEDIUMChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgeryEPSS 0.4%CVE-2026-7177MEDIUMChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgeryEPSS 0.4%CVE-2026-7178MEDIUMChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgeryEPSS 0.3%CVE-2026-7644MEDIUMChatGPTNextWeb NextChat actions.ts addMcpServer improper authorizationEPSS 0.3%