Product by Quantumnous

    New-api

    18 known vulnerabilities in New-api (Quantumnous), 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in New-api (Quantumnous)
    CriticalCVE-2026-71479

    New API: Integer overflow in quota billing yields negative charges (self-crediting)

    also in 1 other product

    		9.1
    CriticalCVE-2026-64859

    New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

    also in 1 other product

    		9.1
    HighCVE-2026-41432

    New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

    also in 2 other products

    		8.2
    HighCVE-2026-64868

    QuantumNous New-api: Allocation of Resources Without Limits or Throttling

    also in 1 other product

    		7.5
    HighCVE-2026-33655

    New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

    also in 2 other products

    		7.7
    HighCVE-2026-25591

    New API has an SQL LIKE Wildcard Injection DoS via Token Search

    also in 2 other products

    		6.5
    MediumCVE-2026-64866

    New API: Admin can reset passkeys for same-level or higher-privileged users

    also in 1 other product

    		—
    MediumCVE-2026-82909

    QuantumNous new-api Revoked API Token token session expiration

    		4.3
    HighCVE-2025-62155

    QuantumNous New API Has SSRF Bypass

    also in 1 other product

    		8.5
    MediumCVE-2026-64865

    New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

    also in 1 other product

    		—
    HighCVE-2025-59146

    New API has Authenticated Server-Side Request Forgery (SSRF) issue

    		8.5
    HighCVE-2026-42339

    New API: SSRF Filter Bypass via 0.0.0.0

    also in 2 other products

    		7.1
    HighCVE-2026-25802

    New API has Potential XSS in its MarkdownRenderer component

    also in 2 other products

    		7.6
    MediumCVE-2026-9306

    QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

    		3.7
    MediumCVE-2026-30886

    New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

    also in 2 other products

    		6.5
    MediumCVE-2026-9305

    QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection

    		6.3
    MediumCVE-2026-44342

    New API CSRF in email and WeChat account binding endpoints

    also in 2 other products

    		5.3
    MediumCVE-2026-32879

    New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

    also in 2 other products

    		4.9

    All products by Quantumnous