CVE-2026-41432

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

CVSS 3.1

8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

EPSS

0.9% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-26)

CWEs

CWE-345, CWE-863, CWE-1188

Published

2026-05-08

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• newapi:new_api

Packages (OSV)

References

• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4

Check your stackJSON