CVE-2026-44342
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.
- CVSS 3.1
- 5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-25)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- newapi:new_api
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-26v7-h57m-gh9m | Go | github.com/QuantumNous/new-api | <0.12.0-alpha.1 | 0.12.0-alpha.1 |
| GO-2026-5929 | Go | github.com/QuantumNous/new-api | <0.12.0-alpha.1 | 0.12.0-alpha.1 |