Executive brief
New API, a management system for AI assets and Large Language Model (LLM) gateways, contains a security flaw in how it handles account linking. An attacker could trick a logged-in user into clicking a malicious link that silently links the user's account to an email address or WeChat identity controlled by the attacker. This could allow the attacker to potentially take over the account through password recovery processes or gain unauthorized access to the user's AI resources.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in QuantumNous New API prior to version 0.12.0-alpha.1. The application incorrectly used GET requests for state-changing operations at the /api/oauth/email/bind and /api/oauth/wechat/bind endpoints. In environments where session cookies are sent during cross-site navigations (e.g., non-strict SameSite configurations), an unauthenticated remote attacker can use social engineering to trigger a victim's browser to perform an account binding operation. This allows the attacker to bind their own email or OAuth identity to the victim's account, potentially enabling subsequent account takeover via password reset flows. The issue is mitigated by the default 'SameSite=Strict' cookie setting in modern browsers but remains exploitable in specific deployment scenarios. The fix refactors these endpoints to use POST requests with JSON bodies.
Affected products
- QuantumNous new-api < 0.12.0-alpha.1
Timeline
- 2026-03-31: patched: Version 0.12.0-alpha.1 released
- 2026-07-03: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE published to NVD