new-api CVE-2026-44342
MEDIUM
GHSA-26v7-h57m-gh9m
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the SameSite=Strict default that blocks most CSRF paths; I:H because successful binding enables account takeover via follow-on recovery flows.
Primary rating from Vendor (https://github.com/QuantumNous/new-api).
CVSS VectorVendor: https://github.com/QuantumNous/new-api
Lifecycle Timeline
1DescriptionCVE.org
Summary
The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.
Affected endpoints included:
GET /api/oauth/email/bindGET /api/oauth/wechat/bind
Impact
A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses SameSite=Strict, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.
Affected versions
Versions before v0.12.0-alpha.1 are affected.
Patches
This issue is fixed in v0.12.0-alpha.1. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.
Workarounds
If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to /api/oauth/email/bind and /api/oauth/wechat/bind at the reverse proxy.
Resources
- Fixed by commit
e099117c61391abdf888fb75e382a582e550bd0e. - Relevant code paths:
router/api-router.goandcontroller/user.go.
AnalysisAI
Cross-site request forgery in new-api's OAuth account binding endpoints allows an unauthenticated network attacker to silently rebind a logged-in user's email or WeChat identity to attacker-controlled credentials by luring the victim to a malicious page. Affected are all deployments running versions prior to v0.12.0-alpha.1 where the GET-based bind endpoints are reachable. No public exploit has been identified at time of analysis, and the default SameSite=Strict cookie configuration substantially limits real-world exploitability to environments that have weakened or overridden that default.
Technical ContextAI
The vulnerability (CWE-352, Cross-Site Request Forgery) arises from a fundamental HTTP semantics violation: the endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind perform state-changing operations (account identity binding) using an idempotent HTTP method. Because browsers send cookies on same-origin GET navigations and some cross-site navigations, a forged link or image tag is sufficient to trigger the operation without a CSRF token. The affected package, pkg:go/github.com_quantumnous_new-api, is a Go-based API gateway; the vulnerable code paths are router/api-router.go and controller/user.go. CWE-352 root cause: the server relied solely on session cookie presence rather than requiring an unpredictable anti-CSRF token or a non-GET method for mutation.
RemediationAI
The vendor-released patch is v0.12.0-alpha.1, which converts the email and WeChat binding routes from GET to POST and reads parameters from a JSON request body, eliminating the CSRF attack surface. Operators should upgrade to v0.12.0-alpha.1 or later; the fix commit is e099117c61391abdf888fb75e382a582e550bd0e (https://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e). If an immediate upgrade is not feasible, two compensating controls can reduce risk: first, verify that session cookies retain their default SameSite=Strict attribute and that no reverse proxy or load balancer is stripping or downgrading the attribute - this single control prevents exploitation in all tested modern browsers; second, configure the reverse proxy to block or return 405 for GET requests to /api/oauth/email/bind and /api/oauth/wechat/bind, which removes the attack surface at the network layer without application changes. Note that blocking those GET endpoints may break any existing client integrations that call them directly, so operators should audit API consumers before deploying the proxy rule.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today