CVE-2026-41432

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

Affected Software

VendorProductVersion RangeStatus
QuantumNousnew-api< 0.12.10affected

Weaknesses

  • CWE-345: CWE-345: Insufficient Verification of Data Authenticity
  • CWE-1188: CWE-1188: Insecure Default Initialization of Resource
  • CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References