CVE-2026-41432

HighCVSS 8.2/10Last modified Oct 26, 2026

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-345 CWE-863 CWE-1188

Affected software

Vendor	Product	Versions
QuantumNous	new-api	< 0.12.10

References

https://github.com/QuantumNous/new-api/releases/tag/v0.12.10Product, Release Notes
https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory
https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory

Timeline

Published: May 8, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-414338.4OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in CVE-2026-414343.3OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-414458.8KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allo CVE-2026-414469.8Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the CVE-2026-414477.8FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing CVE-2026-414489.4AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to CVE-2026-414497.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allo CVE-2026-41457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticat CVE-2026-414507.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function whe CVE-2026-414517.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within CVE-2026-414529.8Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to CVE-2026-414538.8Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access