Is CVE-2026-44342 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44342 being exploited in the wild.

How severe is CVE-2026-44342?

Medium severity, with a CVSS score of 5.3, published 9 July 2026.

Which products and versions are affected?

github.com/QuantumNous/new-api (Go) < 0.12.0-alpha.1, SEMVER:introduced=0,fixed=0.12.0-alpha.1; QuantumNous New API < 0.12.0-alpha.1.

Is there a fix for CVE-2026-44342?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44342 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44342?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44342: QuantumNous New API CSRF in account binding endpoints

Q: Is there a fix for CVE-2026-44342?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44342 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44342?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44342 · Severity: medium · CVSS 5.3 · Published 2026-07-09

New API, a management system for AI assets and Large Language Model (LLM) gateways, contains a security flaw in how it handles account linking. An attacker could trick a logged-in user into clicking a malicious link that silently links the user's account to an email address or WeChat identity controlled by the attacker. This could allow the attacker to potentially take over the account through password recovery processes or gain unauthorized access to the user's AI resources.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-44342 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44342 being exploited in the wild.
How severe is CVE-2026-44342?: Medium severity, with a CVSS score of 5.3, published 9 July 2026.
Which products and versions are affected?: github.com/QuantumNous/new-api (Go) < 0.12.0-alpha.1, SEMVER:introduced=0,fixed=0.12.0-alpha.1; QuantumNous New API < 0.12.0-alpha.1.
Is there a fix for CVE-2026-44342?: Yes. github.com/QuantumNous/new-api (Go): upgrade to 0.12.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44342 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44342?: Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/QuantumNous/new-api (Go): upgrade to 0.12.0-alpha.1 or later
```
go get github.com/QuantumNous/new-api@v0.12.0-alpha.1
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in QuantumNous New API prior to version 0.12.0-alpha.1. The application incorrectly used GET requests for state-changing operations at the /api/oauth/email/bind and /api/oauth/wechat/bind endpoints. In environments where session cookies are sent during cross-site navigations (e.g., non-strict SameSite configurations), an unauthenticated remote attacker can use social engineering to trigger a victim's browser to perform an account binding operation. This allows the attacker to bind their own email or OAuth identity to the victim's account, potentially enabling subsequent account takeover via password reset flows. The issue is mitigated by the default 'SameSite=Strict' cookie setting in modern browsers but remains exploitable in specific deployment scenarios. The fix refactors these endpoints to use POST requests with JSON bodies.

Affected products

QuantumNous new-api < 0.12.0-alpha.1

Identifiers

CVE-2026-44342
GHSA-26v7-h57m-gh9m
GO-2026-5929

Timeline

2026-03-31: patched: Version 0.12.0-alpha.1 released
2026-07-03: advisory: GitHub Security Advisory published
2026-07-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.