Integer Overflow in Quota Billing Leads to Negative Charges and Self-Crediting

Vulnerability Overview Vulnerability Name: Integer overflow in quota billing leads to negative charges (self-crediting) Vulnerability Description: Multiple billing entry points directly pass user-controllable quantity parameters into quota calculations without proper upper-bound checks or overflow-safe numeric conversions. Attackers can craft extreme values (e.g., values exceeding the int32 max range that wrap around to become a large negative number). This negative value then takes effect during the settlement phase, effectively increasing the user's balance. Vulnerability Impact: Low-privilege users with a positive account balance can exploit a single crafted request to trigger an abnormal, huge recharge to their own account (negative settlement = credit), compromising billing integrity and generating fake balances out of thin air. Exploitability: Confirmed to be exploited in the wild. Vulnerability Timeline: - 2026-07-06 23:00 - Community user @lhuji12388 reported that their deployed instance was exploited via this vulnerability (logs showed large negative spending amounts and abnormal increases in account balances). - 26-07-07 01:17 - Emergency fix version v1.0.0-rc.17 was released, approximately 2 hours after receiving the feedback. - 2026-07-07 (Next Day) - Given the discovery of active exploitation, to allow all deployers to upgrade and investigate immediately, the vulnerability and the fix version were publicly disclosed in the community on the same day. - 2026-07-07 13:19 - Version v1.0.0-rc.18 was released, adding observability capabilities such as quota saturation alert logs to facilitate operator auditing and abuse monitoring. Affected Scope Affected Parameters: - Image generation count (request body, multipart forms, and AI passthrough across various paths) - Video/async task duration / , as well as duration in metadata (Veo , overwrite) - Output length limits / / (OpenAI, Claude, Gemini, and Responses four formats) - Audio duration metering (transcription uploaded file metadata, TTS response duration, upload return four-value function) - Floating-point conversions for various quota calculations (text/audio/real-time/task stage endpoint billing, tool surcharges) Prerequisites for Trigger: - This vulnerability is not triggered with a zero balance. There are clear prerequisites for triggering: - The attacker must hold an account with a wallet balance >= 0, sufficient to cover at least the pre-consumed quota amount for a normal (unamplified) request. The pre-consumption entry directly returns a 403 if or if . Therefore, zero balance or insufficient balance cannot proceed to the settlement phase. - Quantity multipliers ( , duration, etc.) do not take effect during the pre-consumption phase; pre-consumption is always based on positive decimals. The overflow only occurs during the settlement phase ( / task sign-off settlement), causing the actual quota to wrap around to a negative value, thereby crediting the account. - Subscription billing logic is similar: a valid subscription is required, and negative settlement will credit the subscription quota. Conditions for Escalating Harm: - When the deployer enables any feature that allows "obtaining a positive balance at zero cost," the "positive balance" prerequisite can be met by attackers at low cost and in bulk. This lowers the attack threshold significantly and escalates the risk (classified as High Severity): - Check-in rewards ( , ): Daily check-ins distribute quota. - Invitation rebates ( / , ): Inviter/invitee receive quota. - New user bonus quota ( , ): Initial quota is distributed upon registration. - This project defaults to enabling self-registration. Once any of the above features are enabled, attackers can register (or batch-register) accounts to obtain free starting balances, then use a single crafted request to overflow the balance, effectively equivalent to unauthenticated exploitation. Remediation Fixed Versions: >= 1.0.0-rc.18 Remediation Measures: - Entry Validation: Reasonable upper limits are set for all user-controllable quantities during the request validation phase. Out-of-bounds values return a 400 error directly (e.g., , , , etc.). - Bypass Restrictions: Similar quantity constraints are applied to passthrough fields, metadata, multipart data, and historical task data in their respective paths. - Saturation and Conversion Safeguards: All quota numeric conversions are centralized in ( / / ) and are consistently saturated to the int32 boundary, never wrapping around. / delegates to this same implementation. - Enhanced Observability: When saturation occurs, it is recorded in related to consumption/task tasks (visible only to administrators), and a short log with the request ID is output to facilitate auditing and tracking of abuse. Handling Recommendations: - Upgrade to version 1.0.0-rc.18 or higher. - Review historical logs for negative spending records, and reconcile and correct balances for affected accounts. - Review account bal

Goal Reached Thanks to every supporter — we hit 100%!

Integer Overflow in Quota Billing Leads to Negative Charges and Self-Crediting

More from this source