New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
References
| Link | Resource |
|---|---|
| https://github.com/QuantumNous/new-api/releases/tag/v0.12.10 | Product Release Notes |
| https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 | Exploit Mitigation Vendor Advisory |
| https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 | Exploit Mitigation Vendor Advisory |
Configurations
History
18 May 2026, 18:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/QuantumNous/new-api/releases/tag/v0.12.10 - Product, Release Notes | |
| References | () https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Newapi
Newapi new Api |
|
| CPE | cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* |
12 May 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 - |
08 May 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 23:16
Updated : 2026-05-18 18:28
NVD link : CVE-2026-41432
Mitre link : CVE-2026-41432
CVE.ORG link : CVE-2026-41432
JSON object : View
Products Affected
newapi
- new_api