https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:00:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335627 EUVD-2026-335627 https://cve.radiocsirt.org/vuln/euvd-2026-335627 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44342 <p>New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user&#39;s browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.</p> <p>New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user&#39;s browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44342 https://cve.radiocsirt.org/vuln/ghsa-26v7-h57m-gh9m <p><strong>Affected:</strong> Go: github.com/QuantumNous/new-api</p> <p>## Summary</p> <p>The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user&#39;s browser to bind an attacker-controlled email address or OAuth identity.</p> <p>Affected endpoints included:</p> <p>- `GET /api/oauth/email/bind` - `GET /api/oauth/wechat/bind`</p> <p>## Impact</p> <p>A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses `SameSite=Strict`, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.</p> <p>## Affected versions</p> <p>Versions before `v0.12.0-alpha.1` are affected.</p> <p>## Patches</p> <p>This issue is fixed in `v0.12.0-alpha.1`. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.</p> <p>## Workarounds</p> <p>If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to `/api/oauth/email/bind` and `/api/oauth/wechat/bind` at the reverse proxy.</p> <p>## Resources</p> <p>- Fixed by commit `e099117c61391abdf888fb75e382a582e550bd0e`. - Relevant code paths: `router/api-router.go` and `c…</p> <p><strong>Affected:</strong> Go: github.com/QuantumNous/new-api</p> <p>## Summary</p> <p>The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user&#39;s browser to bind an attacker-controlled email address or OAuth identity.</p> <p>Affected endpoints included:</p> <p>- `GET /api/oauth/email/bind` - `GET /api/oauth/wechat/bind`</p> <p>## Impact</p> <p>A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses `SameSite=Strict`, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.</p> <p>## Affected versions</p> <p>Versions before `v0.12.0-alpha.1` are affected.</p> <p>## Patches</p> <p>This issue is fixed in `v0.12.0-alpha.1`. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.</p> <p>## Workarounds</p> <p>If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to `/api/oauth/email/bind` and `/api/oauth/wechat/bind` at the reverse proxy.</p> <p>## Resources</p> <p>- Fixed by commit `e099117c61391abdf888fb75e382a582e550bd0e`. - Relevant code paths: `router/api-router.go` and `c…</p> https://cve.radiocsirt.org/vuln/ghsa-26v7-h57m-gh9m