# CVE-2026-41432: QuantumNous New API signature bypass in Stripe webhook handler

Source: https://junglewise.ai/threats/cve-2026-41432-quantumnous-new-api-signature-bypass-in-stripe-webhook-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-41432 · Severity: high · CVSS 7.1 · Published 2026-05-08

New API, a gateway for managing AI assets and large language models, contains a vulnerability in its payment processing system. An attacker can bypass the security checks for Stripe payments to falsely credit their account with unlimited usage quota without actually paying. This could lead to significant financial loss for the service provider and unauthorized consumption of expensive AI resources.

Technologies: [github.com/QuantumNous/new-api (Go)](https://junglewise.ai/threats/technologies/github-com-quantumnous-new-api), [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-41432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41432 being exploited in the wild.

**How severe is CVE-2026-41432?** High severity, with a CVSS score of 7.1, published 8 May 2026.

**Which products and versions are affected?** github.com/QuantumNous/new-api (Go) < 0.12.10, SEMVER:introduced=0,fixed=0.12.10; QuantumNous New API < v0.12.10.

**Is there a fix for CVE-2026-41432?** Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41432 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41432?** Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/QuantumNous/new-api (Go): upgrade to 0.12.10 or later

  ```sh
  go get github.com/QuantumNous/new-api@v0.12.10
  ```


## Technical details

The vulnerability arises from three primary flaws in the Stripe webhook implementation. First, the system defaults to an empty StripeWebhookSecret, which allows attackers to generate valid HMAC-SHA256 signatures using an empty key. Second, the handler fails to verify the 'payment_status' field, accepting 'unpaid' sessions as successful. Third, the Recharge function lacks PaymentMethod validation, allowing an attacker to create a pending order via any gateway (like Epay) and fulfill it using a forged Stripe webhook. Attackers can exploit this by retrieving a pending trade_no and sending a crafted POST request to the /api/stripe/webhook endpoint. The issue is patched in version 0.12.10 by requiring a non-empty secret and implementing strict payment method and status verification.

## Affected products

- QuantumNous New API < v0.12.10

## Identifiers

- CVE-2026-41432
- GHSA-xff3-5c9p-2mr4
- GO-2026-5753

## Timeline

- 2026-04-15: patched: Version 0.12.10 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE-2026-41432 published to NVD

## References

- [https://github.com/QuantumNous/new-api/releases/tag/v0.12.10](https://github.com/QuantumNous/new-api/releases/tag/v0.12.10)
- [https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4](https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4)

## Related threats

- [QuantumNous new-api session expiration in Revoked API Token Handler](https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token)
- [QuantumNous New API integer overflow in quota billing](https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing)
- [QuantumNous new-api unauthenticated payment webhook denial of service](https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of)
- [QuantumNous new-api admin passkey reset privilege escalation](https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation)
- [QuantumNous new-api Redis quota cache race condition in user settings update](https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user)