Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

new-api — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in new-api, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the new-api product, specifically focusing on software weaknesses tagged with security advisories from the official vendor. The collection encompasses a comprehensive range of reported issues, including memory corruption, authentication bypasses, and input validation failures, covering the entire product lifecycle from its initial release through the most recent updates. Readers can utilize this resource to track the vendor's historical advisory patterns, analyze the prevalence of specific weakness classes within the new-api architecture, or review the complete vulnerability history of the software to assess current risk exposure. By centralizing these findings, the page provides a clear overview of how security defects have evolved over time without requiring cross-referencing of disparate sources. This consolidated view supports security teams in prioritizing remediation efforts and understanding the long-term stability of the system. The data presented here is derived from public disclosures and vendor communications, offering an objective snapshot of the product's security posture. Users seeking to understand the specific impact of past incidents or to verify the status of known flaws will find the chronological arrangement of entries particularly useful for audit and compliance purposes.

Vendor: QuantumNous

CVE ID Title CVSS Severity Published
CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration CWE-613 4.3 Medium 2026-08-31
CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass CWE-362 6.0 Medium 2026-08-17
CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting) CWE-190 9.1 Critical 2026-08-17
CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users CWE-862 5.1 Medium 2026-08-17
CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging CWE-400 7.5 High 2026-08-17
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation CWE-200 9.1 Critical 2026-08-17
CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints CWE-352 5.3 Medium 2026-07-09
CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CWE-918 7.7 High 2026-07-09
CVE-2026-9306 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization CWE-639 3.7 Low 2026-05-23
CVE-2026-9305 QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection CWE-89 6.3 Medium 2026-05-23
CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0 CWE-918 8.1AI High AI 2026-05-08
CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CWE-345 7.1 High 2026-05-08
CVE-2026-32879 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure CWE-287 4.9 Medium 2026-03-23
CVE-2026-30886 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CWE-639 6.5 Medium 2026-03-23
CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component CWE-79 7.6 High 2026-02-24
CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search CWE-943 6.5AI Medium AI 2026-02-24
CVE-2025-62155 QuantumNous New API Has SSRF Bypass CWE-918 8.5 High 2025-11-24
CVE-2025-59146 New API has Authenticated Server-Side Request Forgery (SSRF) issue CWE-918 8.5 High 2025-10-09

All 18 known CVE vulnerabilities affecting new-api with full Chinese analysis, references, and POCs where available.