CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints

Medium 5.3 Published 9 Jul 2026 Updated 10 Jul 2026

Attackers can force logged-in users to bind attacker-controlled email or WeChat accounts via GET requests, enabling account takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-44342?

CVE-2026-44342 is a medium-severity vulnerability in QuantumNous new-api, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.

Weakness: CWE-352

Which versions are affected by CVE-2026-44342?

3 open source packages ship an affected version, including github.com/QuantumNous/new-api. It affects 1 product.

Package	Affected	Fixed in
`github.com/QuantumNous/new-api` Go	All versions	`0.12.0-alpha.1`
`github.com/QuantumNous/new-api` Go	All versions	`0.12.0-alpha.1`
`github.com/QuantumNous/new-api` Go	All versions	`0.12.0-alpha.1`

Products include Newapi New Api.

How do I fix CVE-2026-44342?

Upgrade github.com/QuantumNous/new-api to 0.12.0-alpha.1 or later.

Is CVE-2026-44342 being exploited?

There is no known exploitation of CVE-2026-44342 in the wild and no public exploit code.

Sources

Also known as GHSA-26v7-h57m-gh9m, GO-2026-5929.