Is CVE-2026-41432 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41432 being exploited in the wild.

How severe is CVE-2026-41432?

High severity, with a CVSS score of 7.1, published 8 May 2026.

Which products and versions are affected?

github.com/QuantumNous/new-api (Go) < 0.12.10, SEMVER:introduced=0,fixed=0.12.10; QuantumNous New API < v0.12.10.

Is there a fix for CVE-2026-41432?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41432 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41432?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41432: QuantumNous New API signature bypass in Stripe webhook handler

Q: Is there a fix for CVE-2026-41432?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41432 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-41432?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41432 · Severity: high · CVSS 7.1 · Published 2026-05-08

New API, a gateway for managing AI assets and large language models, contains a vulnerability in its payment processing system. An attacker can bypass the security checks for Stripe payments to falsely credit their account with unlimited usage quota without actually paying. This could lead to significant financial loss for the service provider and unauthorized consumption of expensive AI resources.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-41432 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41432 being exploited in the wild.
How severe is CVE-2026-41432?: High severity, with a CVSS score of 7.1, published 8 May 2026.
Which products and versions are affected?: github.com/QuantumNous/new-api (Go) < 0.12.10, SEMVER:introduced=0,fixed=0.12.10; QuantumNous New API < v0.12.10.
Is there a fix for CVE-2026-41432?: Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41432 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41432?: Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later
```
go get github.com/QuantumNous/new-api@v0.12.10
```

Technical details

The vulnerability arises from three primary flaws in the Stripe webhook implementation. First, the system defaults to an empty StripeWebhookSecret, which allows attackers to generate valid HMAC-SHA256 signatures using an empty key. Second, the handler fails to verify the 'payment_status' field, accepting 'unpaid' sessions as successful. Third, the Recharge function lacks PaymentMethod validation, allowing an attacker to create a pending order via any gateway (like Epay) and fulfill it using a forged Stripe webhook. Attackers can exploit this by retrieving a pending trade_no and sending a crafted POST request to the /api/stripe/webhook endpoint. The issue is patched in version 0.12.10 by requiring a non-empty secret and implementing strict payment method and status verification.

Affected products

QuantumNous New API < v0.12.10

Identifiers

CVE-2026-41432
GHSA-xff3-5c9p-2mr4
GO-2026-5753

Timeline

2026-04-15: patched: Version 0.12.10 released
2026-04-22: advisory: GitHub Security Advisory published
2026-05-08: disclosed: CVE-2026-41432 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.