New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-41432 · Microsoft / collected KEV context

EUVD-2026-28843

GHSA-xff3-5c9p-2mr4

GO-2026-5753

cve-program · CVE-2026-41432

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10

euvd · EUVD-2026-28843

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10

nvd · CVE-2026-41432

• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4

osv · GHSA-xff3-5c9p-2mr4

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
• https://nvd.nist.gov/vuln/detail/CVE-2026-41432
• https://docs.stripe.com/checkout/fulfillment#async-payment-methods
• https://docs.stripe.com/webhooks#verify-official-libraries
• https://github.com/QuantumNous/new-api
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10

osv · GO-2026-5753

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
• https://nvd.nist.gov/vuln/detail/CVE-2026-41432
• https://docs.stripe.com/checkout/fulfillment#async-payment-methods
• https://docs.stripe.com/webhooks#verify-official-libraries
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10

No related operational record is retained in the current change model.