{"id":"GO-2026-5929","revision":"56177b9298a64a20929313b019db8832","records":[{"revision":"56177b9298a64a20929313b019db8832","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5929","aliases":["CVE-2026-44342","GHSA-26v7-h57m-gh9m"],"title":"New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api","description":"New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api","state":0,"publishedAt":"2026-07-17T19:42:05+00:00","modifiedAt":"2026-07-21T19:15:29.1473147+00:00","affected":[{"ecosystem":"Go","name":"github.com/QuantumNous/new-api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.12.0-alpha.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m","https://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5929","license":"OSV · upstream source license applies","key":"osv:GO-2026-5929","identifiers":["GO-2026-5929","CVE-2026-44342","GHSA-26v7-h57m-gh9m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}