CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
An unauthenticated attacker can bypass Stripe webhook signature verification to credit arbitrary quota to their account without payment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41432?
CVE-2026-41432 is a high-severity authentication bypass vulnerability in QuantumNous new-api, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
Which versions are affected by CVE-2026-41432?
3 open source packages ship an affected version, including github.com/QuantumNous/new-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/QuantumNous/new-api Go | All versions | 0.12.10 |
github.com/QuantumNous/new-api Go | All versions | 0.12.10 |
github.com/QuantumNous/new-api Go | All versions | 0.12.10 |
Products include Newapi New Api.
How do I fix CVE-2026-41432?
Upgrade github.com/QuantumNous/new-api to 0.12.10 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-41432 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41432 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in QuantumNous new-api
- CVE-2025-55573 Cross-site scripting in n/a
- CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
- CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component
- CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0
- CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search
Sources
Also known as GHSA-xff3-5c9p-2mr4, GO-2026-5753.