CVE-2026-41432 Details
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
A vulnerability in the Stripe webhook handler of New API versions prior to 0.12.10 allows unauthenticated attackers to forge webhook events and receive arbitrary quota credits without making any payments. This issue arises because the webhook endpoint does not reject requests with an empty secret, enabling attackers to create valid signatures that bypass verification. Additionally, the system fails to validate payment methods, allowing cross-gateway exploitation.
Users should upgrade to New API version 0.12.10, which addresses the vulnerability by rejecting empty webhook secrets, verifying payment statuses, and validating payment methods. For those unable to upgrade immediately, set the Stripe webhook secret to a non-empty value or block the webhook endpoint if Stripe is not in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/QuantumNous/new-api/releases/tag/v0.12.10 | [email protected] | ProductRelease Notes |
| https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| newapi new api | < 0.12.10 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |