Executive brief
NextChat is an AI chat assistant application that supports multiple models including GPT and Claude. A vulnerability in versions 2.15.8 through 2.16.1 allows attackers to steal the server's OpenAI API key by crafting requests to a proxy endpoint. An attacker can exploit this to access the server's credentials and make unauthorized API calls at the victim's expense.
Technical details
The vulnerability is an improper URL validation flaw in the proxy endpoint (app/api/proxy.ts). The code uses substring matching (`baseUrl?.includes("api.openai.com")`) to validate the x-base-url header instead of proper hostname parsing. This allows an attacker to bypass validation by sending any URL containing "api.openai.com" (e.g., "http://attacker.com/api.openai.com"), and the server will forward the OpenAI API key in the Authorization header to the attacker's server. The attack is network-accessible and requires no authentication or user interaction beyond crafting a specially-formed request. Patches are available in versions after 2.16.1.
Affected products
- ChatGPTNextWeb NextChat 2.15.8 through 2.16.1
Timeline
- 2026-08-30: disclosed