Product by Go
Github.com/quantumnous/new-api
14 known vulnerabilities in Github.com/quantumnous/new-api (Go), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-71479 | New API: Integer overflow in quota billing yields negative charges (self-crediting) | 9.1 | |
| Critical | CVE-2026-64859 | New API: User List API Leaks Root User Access Token Leading to Privilege Escalation | 9.1 | |
| High | CVE-2026-41432 | New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud | 8.2 | |
| High | CVE-2026-64868 | QuantumNous New-api: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-33655 | New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs | 7.7 | |
| High | CVE-2026-25591 | New API has an SQL LIKE Wildcard Injection DoS via Token Search | 6.5 | |
| Medium | CVE-2026-64866 | New API: Admin can reset passkeys for same-level or higher-privileged users | — | |
| High | CVE-2025-62155 | QuantumNous New API Has SSRF Bypass | 8.5 | |
| Medium | CVE-2026-64865 | New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass | — | |
| High | CVE-2026-42339 | New API: SSRF Filter Bypass via 0.0.0.0 | 7.1 | |
| High | CVE-2026-25802 | New API has Potential XSS in its MarkdownRenderer component | 7.6 | |
| Medium | CVE-2026-30886 | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check | 6.5 | |
| Medium | CVE-2026-44342 | New API CSRF in email and WeChat account binding endpoints | 5.3 | |
| Medium | CVE-2026-32879 | New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure | 4.9 |