NextChat CVE-2026-82639

The NextChat instance must have a server-side OpenAI API key configured (as opposed to requiring users to provide their own keys). The proxy endpoint must be network-accessible to the attacker - this is a typical deployment pattern for self-hosted NextChat instances exposed to the internet. No authentication, special account, or user interaction is required; the CVSS vector (PR:N, UI:N) confirms unauthenticated remote exploitation. What limits exploitation: instances that require end users to input their own API keys (no server-held credential) are not vulnerable to key exfiltration even if the URL bypass succeeds. Deployments where the proxy endpoint is restricted to an internal network or behind authentication middleware are also not directly exposed. The vulnerability is version-bounded to 2.15.8-2.16.1.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the severity: the attack is remotely executable, requires no privileges or user interaction, and yields high confidentiality impact through API key exfiltration. The impact is specifically limited to theft of the configured OpenAI API key - there is no integrity or availability impact on the NextChat host itself, nor on downstream systems (SC/SI/SA all N). EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified probabilistically. The vulnerability is not in CISA KEV, and no weaponized exploit has been confirmed. However, the flaw is mechanically simple: a single HTTP request with a crafted header is sufficient, and the GitHub issue publicly documents the vulnerability, lowering the bar for discovery. For any self-hosted NextChat deployment that exposes the proxy endpoint to the internet and stores a funded OpenAI API key, this represents an immediate financial risk - stolen keys can be abused to run large inference workloads at the victim's expense. The absence of authentication requirements makes mass scanning feasible.

An attacker discovers a publicly accessible NextChat instance via a search engine or targeted scan. The attacker sends a single HTTP request to the proxy endpoint with the header x-base-url set to 'https://attacker-controlled-server.com/capture/api.openai.com', which passes the substring validation. NextChat forwards the request to the attacker's server with the OpenAI API key in the Authorization header, which the attacker logs and immediately uses to make inference API calls billed to the victim.