CVE-2026-82639

NextChat (ChatGPT-Next-Web) versions 2.15.8 through 2.16.1 contain an improper URL validation flaw (CWE-20) in the server-side proxy endpoint that can leak the server's configured OpenAI API key. The proxy validates the attacker-controlled x-base-url header using substring matching instead of hostname parsing, so any URL merely containing 'api.openai.com' passes validation, and the server sends its credentials in the Authorization header to that attacker-chosen URL. An unauthenticated remote attacker who can reach the proxy endpoint can therefore retrieve the operator's OpenAI API key and abuse it for their own API calls at the operator's expense. Operators running affected NextChat versions with a server-configured OpenAI key on a reachable proxy endpoint are affected. Exploitation has not been observed: no public proof of concept exists, the flaw is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation within 30 days.

What to do: Upgrade NextChat to a fixed release newer than 2.16.1 (the data does not specify a fixed version number). Until patched, restrict access to the proxy endpoint (e.g., require authentication or limit it by firewall), and if the endpoint was internet-exposed, rotate the stored OpenAI API key and review access logs for requests carrying unusual x-base-url values.