EUVD-2026-60262
GHSA-8r8v-xf7q-rcpr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitation needs an authenticated funded account, so PR:L not PR:N; no data disclosure gives C:N, while billing-integrity corruption and upstream fund drain justify I:H and A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.
AnalysisAI
Financial fraud via integer overflow in QuantumNous New API (an LLM gateway and AI asset-management platform) lets a low-privileged account with a positive balance or active subscription manipulate user-controlled billing multipliers so that a computed charge wraps into account credit and can drain upstream provider funds. The flaw sits in quota settlement math (common/quota_math.go and related paths) across image, video, audio, and token-count fields, and is fixed in 1.0.0-rc.18. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated New API account that is low-privileged but must hold a positive balance or an active subscription - that funded/active state is the explicit prerequisite named in the advisory, because settlement paths only trigger for accounts eligible to be charged. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority integrity/financial-abuse issue rather than a theoretical high-CVSS artifact, but the input signals conflict on one key point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to New API 1.0.0-rc.18, which is the vendor-released patch (https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.18); this adds saturating quota conversion and input bounds on all billing multipliers and is the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable QuantumNous New API in production, revoke all API tokens, and preserve audit logs for forensic analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today