Skip to content
Heist/ feed
High

NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

Type: advisorySource: Official CVE List1 source record

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

Announced Source revision 1
Original source ↗

CVE-2026-82639

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-82639

NextChat

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "ChatGPTNextWeb",
    "product": "NextChat",
    "versions": [
      {
        "status": "affected",
        "version": "2.15.8",
        "versionType": "semver",
        "lessThanOrEqual": "2.16.1"
      }
    ],
    "packageURL": "pkg:github/ChatGPTNextWeb/NextChat",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-82639

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#1548 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement