{"id":"EUVD-2026-42750","enisaUuid":"4afc9d6e-3ef5-3b19-83c9-ca0f4078583d","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user\u0027s browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.","datePublished":"Jul 9, 2026, 10:33:06 PM","dateUpdated":"Jul 10, 2026, 2:44:38 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m\nhttps://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e\nhttps://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1\n","aliases":"CVE-2026-44342\nGHSA-26v7-h57m-gh9m\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"fe2008fe-0b42-3ecb-9183-5b960b29d512","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 0.12.0-alpha.1"}],"enisaIdVendor":[{"id":"f2cfccc4-3eb1-3147-9a65-ef663362abfb","vendor":{"name":"QuantumNous"}}],"enisaIdVulnerability":[{"id":"5f61141f-45ce-39b4-b220-37067a687008","vulnerability":{"id":"CVE-2026-44342","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user\u0027s browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.","datePublished":"Jul 9, 2026, 10:33:06 PM","dateUpdated":"Jul 10, 2026, 2:44:38 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m\nhttps://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e\nhttps://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1\n","enisa_id":"EUVD-2026-42750\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"a5b7f6b2-b6b4-3368-92e5-f8d61c960bd4","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 0.12.0-alpha.1"}],"vulnerabilityVendor":[{"id":"e1e18308-b630-3991-b2be-cf73d9f324a0","vendor":{"name":"QuantumNous"}}]}},{"id":"f28e5c95-b978-3556-a281-527453a032fd","vulnerability":{"id":"GHSA-26v7-h57m-gh9m","description":"New API is vulnerable to CSRF through user email binding","datePublished":"Jul 7, 2026, 1:01:49 PM","dateUpdated":"Jul 7, 2026, 1:01:49 PM","baseScore":0.0,"references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m\nhttps://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e\nhttps://github.com/QuantumNous/new-api\n","enisa_id":"EUVD-2026-42750\n","aliases":"GHSA-26v7-h57m-gh9m\nCVE-2026-44342\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}