New Api EUVD-2026-14518

This vulnerability presents a moderate-to-high real-world risk despite the CVSS 6.5 score (Medium). The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network accessibility, low attack complexity, and only low privilege requirement (authenticated user), making exploitation trivial for any authenticated user without user interaction. The confidentiality impact is high: attackers gain unauthorized access to other users' video content and can trigger authentication to third-party AI providers (Google Gemini, OpenAI) using stolen task credentials, potentially enabling lateral movement or credential harvesting. The missing authorization check is a single function call—a critical control point—suggesting the vulnerability is easily discoverable and likely already known or exploited within security research communities. The availability of a vendor patch (version 0.11.4-alpha.2) and documented commit (50ec2bac6b341e651fc9ac4344e3bd2cdaeafdbd) indicates rapid remediation, but the alpha versioning suggests this may be a less mature product with potentially slower adoption of security updates. Without confirmed KEV status or active exploitation data, this remains a high-priority issue for any organization using New API in multi-tenant environments, particularly those handling sensitive video data or relying on integrated AI provider access.

An attacker with valid credentials to New API observes or guesses a task_id belonging to another user (e.g., task_id 12345). The attacker crafts a simple GET request to /v1/videos/12345/content and receives the video content and associated AI provider credentials for that task without any authorization challenge. The attacker then uses the stolen credentials to authenticate directly to Google Gemini or OpenAI on behalf of the legitimate task owner, enabling them to perform API calls at the victim's quota or cost. Because the endpoint requires only authentication (not authorization), any user account—including low-privilege accounts—can perform this attack at scale across all task_ids in the system.