Quantumnous New-api vulnerabilities

• quantumnous new-api QuantumNous new-api Revoked API Token token session expiration CVE-2026-82909 5.3 MediumAugust 31, 2026
• quantumnous new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass CVE-2026-64865 Fix available 6.0 MediumAugust 17, 2026
• quantumnous new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) CVE-2026-71479 Fix available 9.1 CriticalAugust 17, 2026
• quantumnous new-api New API: Admin can reset passkeys for same-level or higher-privileged users CVE-2026-64866 Fix available 5.1 MediumAugust 17, 2026
• quantumnous new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging CVE-2026-64868 Fix available 7.5 HighAugust 17, 2026
• quantumnous new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation CVE-2026-64859 Fix available 9.1 CriticalAugust 17, 2026
• newapi new api, quantumnous new-api +1 more New API CSRF in email and WeChat account binding endpoints CVE-2026-44342 Fix available 5.3 MediumJuly 7, 2026
• newapi new api, quantumnous new-api +1 more New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655 Fix available 7.7 HighJuly 7, 2026
• quantumnous new-api QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization CVE-2026-9306 6.3 MediumMay 23, 2026
• quantumnous new-api QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection CVE-2026-9305 5.3 MediumMay 23, 2026
• newapi new api, quantumnous new-api +1 more New API: SSRF Filter Bypass via 0.0.0.0 CVE-2026-42339 7.1 HighMay 6, 2026
• newapi new api, quantumnous new-api +1 more New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVE-2026-41432 Fix available 7.1 HighApril 24, 2026
• newapi new api, quantumnous new-api +1 more New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure CVE-2026-32879 4.9 MediumMarch 23, 2026
• newapi new api, quantumnous new-api +1 more New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVE-2026-30886 Fix available 6.5 MediumMarch 23, 2026
• newapi new api, quantumnous new-api +1 more New API has Potential XSS in its MarkdownRenderer component CVE-2026-25802 Fix available 7.6 HighFebruary 23, 2026
• newapi new api, quantumnous new-api +1 more New API has an SQL LIKE Wildcard Injection DoS via Token Search CVE-2026-25591 Fix available 7.1 HighFebruary 23, 2026
• quantumnous new-api QuantumNous New API Has SSRF Bypass CVE-2025-62155 Fix available 8.5 HighNovember 24, 2025
• quantumnous new-api New API has Authenticated Server-Side Request Forgery (SSRF) issue CVE-2025-59146 8.5 HighOctober 9, 2025