{"id":"EUVD-2025-198983","enisaUuid":"fc64c174-40d3-348c-b168-50c7266a2aff","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.\nBecause the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.","datePublished":"Nov 24, 2025, 11:56:52 PM","dateUpdated":"Nov 25, 2025, 7:30:37 PM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4\n","aliases":"CVE-2025-62155\nGHSA-9f46-w24h-69w4\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"8cca00b0-fac6-3004-b882-d656c7005295","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 0.9.6"}],"enisaIdVendor":[{"id":"c292091a-59d5-3558-89f9-2e378e72f894","vendor":{"name":"QuantumNous"}}],"enisaIdVulnerability":[{"id":"15243e8d-a99e-3ab7-9cbc-50a73fed0a4b","vulnerability":{"id":"CVE-2025-62155","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.\nBecause the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.","datePublished":"Nov 24, 2025, 11:56:52 PM","dateUpdated":"Nov 25, 2025, 7:30:37 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4\n","enisa_id":"EUVD-2025-198983\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 6, 2026, 7:20:53 AM","vulnerabilityProduct":[{"id":"8a90fb2d-0955-37e8-9ab7-43becf5643f3","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 0.9.6"}],"vulnerabilityVendor":[{"id":"e8564548-94a8-30fd-a196-291a6fb3bf75","vendor":{"name":"QuantumNous"}}]}},{"id":"22c69cc2-cadc-32a7-8bc8-8cf6538ef936","vulnerability":{"id":"GHSA-9f46-w24h-69w4","description":"new-api is vulnerable to SSRF Bypass","datePublished":"Nov 24, 2025, 8:05:21 PM","dateUpdated":"Dec 17, 2025, 12:31:18 AM","baseScore":0.0,"references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62155\nhttps://github.com/QuantumNous/new-api/commit/e8966c73746d35bb7f4f014ad1195a96d445cacd\nhttps://github.com/QuantumNous/new-api\n","enisa_id":"EUVD-2025-198983\n","aliases":"CVE-2025-62155\nGHSA-9f46-w24h-69w4\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}