CVE-2026-44342 Details
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.
A cross-site request forgery (CSRF) vulnerability has been identified in New API's account binding endpoints for email and WeChat. Prior to version 0.12.0-alpha.1, these endpoints used GET requests for operations that changed account state. This allowed an attacker to exploit cross-site navigation to bind an email address or WeChat account controlled by the attacker to a victim's account. The vulnerability was possible in environments where session cookies were sent with cross-site requests.
Users can upgrade to New API version 0.12.0-alpha.1 or later, where this vulnerability is fixed. The update changes the binding endpoints to use POST requests with JSON bodies, improving security by preventing CSRF attacks. If an immediate upgrade is not possible, session cookies should be configured with strict SameSite attributes to block cross-site cookie transmission, and GET requests to the binding endpoints should be blocked at the reverse proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| newapi new api | < 0.12.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |