{"id":"GHSA-26v7-h57m-gh9m","revision":"0e40dcba544f4c41b4800e592103e78d","records":[{"revision":"0e40dcba544f4c41b4800e592103e78d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-26v7-h57m-gh9m","aliases":["CVE-2026-44342","GO-2026-5929"],"title":"New API is vulnerable to CSRF through user email binding","description":"## Summary\n\nThe email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.\n\nAffected endpoints included:\n\n- `GET /api/oauth/email/bind`\n- `GET /api/oauth/wechat/bind`\n\n## Impact\n\nA successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses `SameSite=Strict`, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.\n\n## Affected versions\n\nVersions before `v0.12.0-alpha.1` are affected.\n\n## Patches\n\nThis issue is fixed in `v0.12.0-alpha.1`. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.\n\n## Workarounds\n\nIf upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to `/api/oauth/email/bind` and `/api/oauth/wechat/bind` at the reverse proxy.\n\n## Resources\n\n- Fixed by commit `e099117c61391abdf888fb75e382a582e550bd0e`.\n- Relevant code paths: `router/api-router.go` and `controller/user.go`.","state":0,"publishedAt":"2026-07-07T13:01:49+00:00","modifiedAt":"2026-07-21T19:19:20.6475322+00:00","affected":[{"ecosystem":"Go","name":"github.com/QuantumNous/new-api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.12.0-alpha.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m","https://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e","https://github.com/QuantumNous/new-api"],"sourceUrl":"https://github.com/advisories/GHSA-26v7-h57m-gh9m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-26v7-h57m-gh9m","identifiers":["GHSA-26v7-h57m-gh9m","CVE-2026-44342","GO-2026-5929"]},"retained":false,"historicalAffected":[]}],"coverage":[]}