CVE-2026-41432
Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- EPSS
- 0.85% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-345, CWE-863, CWE-1188
- Affected
- newapi/new api
- Source
- security-advisories@github.com
References
- https://github.com/QuantumNous/new-api/releases/tag/v0.12.10Product, Release Notes
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.