CVE-2026-7643 Details
Description
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in ChatGPTNextWeb NextChat versions through 2.16.1, where the application implements a permissive Cross-Origin Resource Sharing (CORS) policy on all API endpoints. This misconfiguration allows any origin to make cross-origin requests, potentially leading to unauthorized access to server resources and API keys. The issue arises from the application's CORS headers, which are set to allow all origins, methods, and headers, including sensitive ones like Authorization. This vulnerability can be exploited remotely, especially if the affected NextChat instance is publicly accessible.
To address this vulnerability, it is recommended to restrict the CORS policy by validating origins against an allowlist, removing 'Access-Control-Allow-Credentials: true', and implementing CSRF protection on state-changing API endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 2, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChatGPTNextWeb/NextChat/ | [email protected] | ProductVendor |
| https://github.com/ChatGPTNextWeb/NextChat/issues/6756 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/806833 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360755 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360755/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChatGPTNextWeb NextChat | <= 2.16.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 2, 2026 | New CVE Received | [email protected] |