ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-41432

PoC —
CVSS 3.1
8.2 high
EPSS
<1%p56
Published
()
Modified
Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

Vendors
newapi
Products
new api
Weakness
CWE-345, CWE-863, CWE-1188
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news

No ingested article mentions this CVE yet.