New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 Exploit, Mitigation, Vendor Advisory
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.2 · newapiNVD modified 2026-10-26 18:10
Affected (CPE criteria) 1
cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*
References 3
- https://github.com/QuantumNous/new-api/releases/tag/v0.12.10 Product, Release Notes
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 Exploit, Mitigation, Vendor Advisory
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4 Exploit, Mitigation, Vendor Advisory