Nextchat
Monthly
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI API key by exploiting flawed URL validation in the proxy endpoint. The x-base-url header is checked using substring matching rather than hostname parsing, so any URL containing the string 'api.openai.com' - including attacker-controlled domains like 'evil.attacker.com/api.openai.com' - passes validation and causes NextChat to forward the OpenAI API key in the Authorization header to the attacker's server. No public exploit identified at time of analysis, though a GitHub issue documenting the flaw is publicly accessible.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI API key by exploiting flawed URL validation in the proxy endpoint. The x-base-url header is checked using substring matching rather than hostname parsing, so any URL containing the string 'api.openai.com' - including attacker-controlled domains like 'evil.attacker.com/api.openai.com' - passes validation and causes NextChat to forward the OpenAI API key in the Authorization header to the attacker's server. No public exploit identified at time of analysis, though a GitHub issue documenting the flaw is publicly accessible.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.