High
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Type: advisorySources: OSV
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41432
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:41 UTC · Revision 1
Source evidence
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
core-osv · Original sourcePublished 8 May 2026, 22:21 UTC
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
osv:CVE-2026-41432
Complete source record
{
"id": "97a40e050292716b4979ad882ba8ae9066c6cc1db2fdd9a2bd7e40f0382df526",
"url": "https://osv.dev/vulnerability/CVE-2026-41432",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud",
"summary": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.",
"evidence": "osv:CVE-2026-41432",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-41432",
"aliases": [
"CVE-2026-41432",
"GHSA-xff3-5c9p-2mr4",
"GO-2026-5753"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/quantumnous/new-api",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b2a40d338170ca50c49bbe7b2e9b7562427867b9"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.12.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "b2a40d338170ca50c49bbe7b2e9b7562427867b9"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.12.10"
},
{
"cpe": "cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.12.10"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v0.12.9",
"v0.12.8",
"v0.12.7",
"v0.12.6",
"v0.12.5",
"v0.12.4",
"v0.12.3",
"v0.12.2",
"v0.12.1",
"v0.12.0",
"v0.12.0-alpha.2",
"v0.12.0-alpha.1",
"v0.11.9",
"v0.11.9-alpha.2",
"v0.11.9-alpha.3",
"v0.11.9-alpha.1",
"v0.11.8",
"v0.11.7",
"v0.11.6-patch.1",
"v0.11.6",
"v0.11.5",
"v0.11.4-patch.1",
"v0.11.4",
"v0.11.4-alpha.5",
"v0.11.4-alpha.4",
"v0.11.4-alpha.3",
"v0.11.4-alpha.2",
"v0.11.4-alpha.1",
"v0.11.2-patch.2",
"v0.11.2-patch.1",
"v0.11.2-alpha.3",
"v0.11.2",
"v0.11.2-alpha.2",
"v0.11.2-alpha.1",
"v0.11.1-alpha.7",
"v0.11.1-alpha.6",
"v0.11.1-alpha.4",
"v0.11.1-alpha.3",
"v0.11.1-alpha.2",
"v0.11.1-alpha.1",
"v0.11.0",
"v0.11.0-alpha.9",
"v0.11.0-alpha.8",
"v0.11.0-alpha.7",
"v0.11.0-alpha.6",
"v0.11.0-alpha.5",
"v0.11.0-alpha.4",
"v0.11.0-alpha.3",
"v0.11.0-alpha.2",
"v0.11.0-alpha.1",
"v0.10.9-alpha.8",
"v0.10.9",
"v0.10.9-alpha.7",
"v0.10.9-alpha.6",
"v0.10.9-alpha.5",
"v0.10.9-alpha.4",
"v0.10.9-alpha.3",
"v0.10.9-alpha.2",
"v0.10.9-alpha.1",
"v0.10.8",
"v0.10.8-alpha.12",
"v0.10.8-alpha.10",
"v0.10.8-alpha.11",
"v0.10.8-alpha.9",
"v0.10.8-alpha.8",
"v0.10.8-alpha.7",
"v0.10.8-alpha.6",
"v0.10.8-alpha.5",
"v0.10.8-alpha.4",
"v0.10.8-alpha.3",
"v0.10.8-alpha.2",
"v0.10.8-alpha.1",
"v0.10.7-alpha.2",
"v0.10.7-alpha.1",
"v0.10.6-alpha.4",
"v0.10.6-alpha.3",
"v0.10.6-alpha.2",
"v0.10.6-alpha.1",
"v0.10.5",
"v0.10.5-ionet.2",
"v0.10.5-checkin.1",
"v0.10.5-bailian.2",
"v0.10.5-bailian.1",
"v0.10.5-ionet.1",
"v0.10.4",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.1-alpha.8",
"v0.10.1-alpha.6",
"v0.10.1-alpha.5",
"v0.10.1-alpha.4",
"v0.10.1-alpha.3",
"v0.10.1-alpha.2",
"v0.10.1-alpha.1",
"v0.10.0",
"v0.10.0-alpha.3",
"v0.10.0-alpha.2",
"v0.10.0-alpha.1",
"v0.9.28",
"v0.9.27-patch.1",
"v0.9.27",
"v0.9.26",
"v0.9.25",
"v0.9.24",
"v0.9.23",
"v0.9.22-patch.1",
"v0.9.22",
"v0.9.21",
"v0.9.20-patch.2",
"v0.9.20-patch.1",
"v0.9.20",
"v0.9.19",
"v0.9.18",
"v0.9.17",
"v0.9.16-patch.1",
"v0.9.16",
"v0.9.15-patch.2",
"v0.9.15-patch.1",
"v0.9.15",
"v0.9.14-patch.1",
"v0.9.14",
"v0.9.13",
"v0.9.12-patch.1",
"v0.9.12",
"v0.9.11",
"v0.9.10",
"v0.9.9-patch.4",
"v0.9.9-patch.3",
"v0.9.9-patch.2",
"v0.9.9-patch.1",
"v0.9.9",
"v0.9.9-aws.3",
"v0.9.9-aws.2",
"v0.9.9-aws.1",
"v0.9.8-patch.1",
"v0.9.8",
"v0.9.7-patch.2",
"v0.9.7-patch.1",
"v0.9.7",
"v0.9.6-patch.1",
"v0.9.6",
"v0.9.5",
"v0.9.4-patch.1",
"v0.9.4",
"v0.9.3-patch.2",
"v0.9.3-patch.1",
"v0.9.3.0",
"v0.9.2.1",
"v0.9.2.0",
"v0.9.1.4",
"v0.9.1.3",
"v0.9.1.2",
"v0.9.1.1.1",
"v0.9.1.1",
"v0.9.1.0",
"v0.9.0.9.1",
"v0.9.0.9",
"v0.9.0.8",
"v0.9.0.1",
"v0.9.0.7",
"v0.9.0.6",
"v0.9.0.5",
"v0.9.0.4",
"v0.9.0.3.3",
"v0.9.0.3.2",
"v0.9.0.3.1",
"v0.9.0",
"v0.8.8.0-alpha.4",
"v0.8.8.0-alpha.3",
"v0.8.8.0-alpha.2",
"v0.8.8.0-alpha.1",
"v0.8.7.5",
"v0.8.7.4",
"v0.8.7.3",
"v0.8.7.2",
"v0.8.7.1",
"v0.8.7.0",
"v0.8.6.2",
"v0.8.5.0",
"v0.8.4.2",
"v0.8.4.1",
"v0.8.4.0",
"v0.8.3.0",
"v0.8.2.0",
"v0.8.1",
"v0.8.0",
"v0.7.3.2",
"v0.7.3.1",
"v0.7.3.0",
"v0.7.2.4",
"v0.7.2.3",
"v0.7.2.2",
"v0.7.2.1",
"v0.7.2.0",
"v0.7.1.3",
"v0.7.1.2",
"v0.7.1.1",
"v0.7.1",
"v0.6.8.2",
"v0.7.0-alpha.2",
"v0.7.0-alpha.1",
"v0.6.8.1",
"v0.6.8.0",
"v0.6.7.1",
"v0.6.7.0",
"v0.6.6.3",
"v0.6.6.2",
"v0.6.6.1",
"v0.6.6.0",
"v0.6.5.1",
"v0.6.5.0",
"v0.6.4.1",
"v0.6.4.0",
"v0.6.3.1.1",
"v0.6.3.1",
"v0.6.3.0",
"v0.6.2.0",
"v0.6.1.1",
"v0.6.1.0",
"v0.6.0.14",
"v0.6.0.13",
"v0.6.0.12",
"v0.6.0.11",
"v0.6.0.10",
"v0.6.0.9",
"v0.6.0.8",
"v0.6.0.7",
"v0.6.0.4",
"v0.6.0.3",
"v0.6.0.2",
"v0.6.0.1",
"v0.6.0",
"v0.6.0-alpha.4",
"v0.6.0-alpha.3",
"v0.6.0-alpha.2",
"v0.6.0-alpha.1",
"v0.5.2.3.1",
"v0.5.2.3",
"v0.5.2.0.1",
"v0.5.2.1.2",
"v0.5.2.1.1",
"v0.5.2.1",
"v0.5.2.0.2",
"v0.5.2.0",
"v0.5.1.0.1",
"v0.5.1.0",
"v0.5.0.1",
"v0.5.0",
"v0.4.9.0",
"v0.4.8.9.6",
"v0.4.8.9.5",
"v0.4.8.8.1",
"v0.4.8.9.4",
"v0.4.8.9.3",
"v0.4.8.9.2",
"v0.4.8.9.1",
"v0.4.8.9",
"v0.4.8.8.3",
"v0.4.8.8.2",
"v0.4.8.8",
"v0.4.8.7.6",
"v0.4.8.7.4",
"v0.4.8.7.3",
"v0.4.8.7.2",
"v0.4.8.7.1",
"v0.4.8.7",
"v0.4.8.6",
"v0.4.8.5.2",
"v0.4.8.5.1",
"v0.4.8.5",
"v0.4.8.4.3",
"v0.4.8.4.2",
"v0.4.8.4.1",
"v0.4.8.4",
"v0.4.8.3",
"v0.4.8.2.2",
"v0.4.8.2.1",
"v0.4.8.2",
"v0.4.8.1",
"v0.4.8.0-alpha.3",
"v0.4.8.0",
"v0.4.8.0-alpha.2",
"v0.4.8.0-alpha.1",
"v0.4.7.3.3",
"v0.4.7.3.1",
"v0.4.7.3",
"v0.4.7.2.1",
"v0.4.7.2",
"v0.4.7.1",
"v0.4.7.0",
"0.4.6.11.4",
"0.4.6.11.3",
"0.4.6.11.2",
"0.4.6.11.1",
"v0.4.6.11",
"v0.4.6.10",
"v0.4.6.8.1",
"v0.4.6.8",
"v0.4.6.7",
"v0.4.6.6",
"v0.4.6.5.1",
"v0.4.6.5",
"v0.4.6.3",
"v0.4.6.2.2",
"v0.4.6.2.1",
"v0.4.6.2",
"v0.4.6.1",
"v0.4.6.0",
"v0.4.5.3",
"v0.4.5.2",
"v0.4.5.1",
"v0.4.5.0",
"v0.4.4.3",
"v0.4.4.2",
"v0.4.4.1",
"v0.4.4.0",
"v0.4.3.1",
"v0.4.3.0",
"v0.4.2.4",
"v0.4.2.3",
"v0.4.2.2",
"v0.4.2.1",
"v0.4.2.0",
"v0.4.1.9",
"v0.4.1.8",
"v0.4.1.7",
"v0.4.1.6",
"v0.4.1.5",
"v0.4.1.4",
"v0.4.1.3",
"v0.4.1.2",
"v0.4.1.1",
"v0.4.0.8",
"v0.4.0.7",
"v0.4.0.6",
"v0.4.0.5",
"v0.4.0.4",
"v0.4.0.3",
"v0.4.0.2",
"v0.4.0.1",
"v0.4.0.0",
"v0.4.0.0-alpha.4",
"v0.4.0.0-alpha.3",
"v0.4.0.0-alpha.2",
"v0.4.0.0-alpha.1",
"v0.3.3.7",
"v0.3.3.6",
"v0.3.3.5",
"v0.3.3.4",
"v0.3.3.3",
"v0.3.3.2",
"v0.3.3.1",
"v0.3.3.0",
"v0.3.2.14",
"v0.3.2.13",
"v0.3.2.12",
"v0.3.2.11",
"v0.3.2.10",
"v0.3.2.9",
"v0.3.2.8",
"v0.3.2.7",
"v0.3.2.6",
"v0.3.2.5",
"v0.3.2.4",
"v0.3.2.3",
"v0.3.2.1",
"v0.3.2.0",
"v0.3.1.8",
"v0.3.1.7",
"v0.3.1.6",
"v0.3.1.5",
"v0.3.1.4",
"v0.3.1.3",
"v0.3.1.2",
"v0.3.1.1",
"v0.3.1.0",
"v0.3.1.0-alpha.5",
"v0.3.1.0-alpha.4",
"v0.3.1.0-alpha.3",
"v0.3.1.0-alpha.2",
"v0.3.1.0-alpha.1",
"v0.3.0.2",
"v0.3.0.1",
"v0.3.0.1-alpha.3",
"v0.3.0.1-alpha.2",
"v0.3.0.1-alpha.1",
"v0.3.0.0-alpha.6",
"v0.3.0.0",
"v0.3.0.0-alpha.5",
"v0.3.0.0-alpha.4",
"v0.3.0.0-alpha.3",
"v0.3.0.0-alpha.2",
"v0.3.0.0-alpha.1",
"v0.2.9.7",
"v0.2.9.6",
"v0.2.9.5",
"v0.2.9.4",
"v0.2.9.3",
"v0.2.9.2",
"v0.2.9.1",
"v0.2.9.0",
"v0.2.8.8",
"v0.2.8.7",
"v0.2.8.6",
"v0.2.8.5",
"v0.2.8.4",
"v0.2.8.3",
"v0.2.8.2",
"v0.2.8.1",
"v0.2.8.1-alpha.1",
"v0.2.8.0",
"v0.2.8.0-alpha.2",
"v0.2.8.0-alpha.1",
"v0.2.7.8",
"v0.2.7.8-alpha.1",
"v0.2.7.7",
"v0.2.7.6-alpha.3",
"v0.2.7.6-alpha.2",
"v0.2.7.6-alpha.1",
"v0.2.7.5",
"v0.2.7.5-alpha.4",
"v0.2.7.5-alpha.3",
"v0.2.7.5-alpha.2",
"v0.2.7.5-alpha.1",
"v0.2.7.4",
"v0.2.7.4-alpha.4",
"v0.2.7.4-alpha.3",
"v0.2.7.4-alpha.2",
"v0.2.7.4-alpha.1",
"v0.2.7.3-alpha.1",
"v0.2.7.3",
"v0.2.7.2-alpha.9",
"v0.2.7.2",
"v0.2.7.2-alpha.8",
"v0.2.7.2-alpha.7",
"v0.2.7.2-alpha.6",
"v0.2.7.2-alpha.5",
"v0.2.7.2-alpha.4",
"v0.2.7.2-alpha.3",
"v0.2.7.2-alpha.2",
"v0.2.7.2-alpha.1",
"v0.2.7.1",
"v0.2.7.1-alpha.11",
"v0.2.7.1-alpha.10",
"v0.2.7.1-alpha.9",
"v0.2.7.1-alpha.8",
"v0.2.7.1-alpha.7",
"v0.2.7.1-alpha.6",
"v0.2.7.1-alpha.5",
"v0.2.7.1-alpha.4",
"v0.2.7.1-alpha.3",
"v0.2.7.1-alpha.2",
"v0.2.7.1-alpha.1",
"v0.2.7.0-alpha.7",
"v0.2.7.0-alpha.6",
"v0.2.7.0-alpha.5",
"v0.2.7.0-alpha.4",
"v0.2.7.0-alpha.3",
"v0.2.7.0-alpha.2",
"v0.2.7.0-alpha.1",
"v0.2.6.0-alpha.1",
"v0.2.5.1-alpha.2",
"v0.2.5.1-alpha.1",
"v0.2.5.0",
"v0.2.5.0-alpha.7",
"v0.2.5.0-alpha.5",
"v0.2.5.0-alpha.4",
"v0.2.5.0-alpha.3",
"v0.2.5.0-alpha.2",
"v0.2.5.0-alpha.1",
"v0.2.4.0-alpha.10",
"v0.2.4.0-alpha.9",
"v0.2.4.0-alpha.8",
"v0.2.4.0-alpha.7",
"v0.2.4.0-alpha.6",
"v0.2.4.0-alpha.5",
"v0.2.4.0-alpha.4",
"v0.2.4.0-alpha.2",
"v0.2.4.0-alpha.1",
"v0.2.3.5",
"v0.2.3.4.1",
"v0.2.3.4",
"v0.2.3.2",
"v0.2.3.1",
"v0.2.3.0",
"v0.2.2.1",
"v0.2.2.0-alpha.26",
"v0.2.2.0-alpha.25",
"v0.2.2.0-alpha.24",
"v0.2.2.0-alpha.23",
"v0.2.2.0-alpha.22",
"v0.2.2.0-alpha.21",
"v0.2.2.0-alpha.20",
"v0.2.2.0-alpha.19",
"v0.2.2.0-alpha.18",
"v0.2.2.0-alpha.17",
"v0.2.2.0-alpha.16",
"v0.2.2.0-alpha.15",
"v0.2.2.0-alpha.14",
"v0.2.2.0-alpha.13",
"v0.2.2.0-alpha.12",
"v0.2.2.0-alpha.11",
"v0.2.2.0-alpha.10",
"v0.2.2.0-alpha.9",
"v0.2.2.0-alpha.8",
"v0.2.2.0-alpha.7",
"v0.2.2.0-alpha.6",
"v0.2.2.0-alpha.5",
"v0.2.2.0-alpha.4",
"v0.2.2.0-alpha.3",
"v0.2.2.0-alpha.2",
"v0.2.2.0-alpha.1",
"v0.2.1.1",
"v0.2.1.0-alpha.35",
"v0.2.1.0-alpha.34",
"v0.2.1.0-alpha.33",
"v0.2.1.0-alpha.32",
"v0.2.1.0-alpha.31",
"v0.2.1.0-alpha.30",
"v0.2.1.0-alpha.29",
"v0.2.1.0-alpha.28",
"v0.2.1.0-alpha.26",
"v0.2.1.0-alpha.25",
"v0.2.1.0-alpha.24",
"v0.2.1.0-alpha.23",
"v0.2.1.0-alpha.22",
"v0.2.1.0-alpha.21",
"v0.2.1.0-alpha.20",
"v0.2.1.0-alpha.19",
"v0.2.1.0-alpha.18",
"v0.2.1.0-alpha.17",
"v0.2.1.0-alpha.16",
"v0.2.1.0-alpha.15",
"v0.2.1.0-alpha.14",
"v0.2.1.0-alpha.13",
"v0.2.1.0-alpha.11",
"v0.2.1.0-alpha.10",
"v0.2.1.0-alpha.9",
"v0.2.1.0-alpha.8",
"v0.2.1.0-alpha.7",
"v0.2.1.0-alpha.6",
"v0.2.1.0-alpha.5",
"v0.2.1.0-alpha.4",
"v0.2.1.0-alpha.3",
"v0.2.1.0-alpha.2",
"v0.2.1.0-alpha.1",
"v0.2.0.3-alpha.2",
"v0.2.0.3-alpha.1",
"v0.2.0.2",
"v0.2.0.1",
"v0.2.0",
"v0.1.3.2",
"v0.1.3.1",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"0.1.0-alpha.1",
"v0.0.8",
"v0.0.7",
"v0.0.6",
"v0.0.5",
"v0.0.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41432.json"
}
}
],
"modified": "2026-10-28T02:30:25.477739528Z",
"provider": "osv",
"references": [
"https://github.com/QuantumNous/new-api/releases/tag/v0.12.10",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41432.json",
"https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41432"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1188",
"CWE-345",
"CWE-863"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41432.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41432",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491954,
"published_at": "2026-05-08T22:21:32.305+00:00"
}