CVE-2026-41432

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

• CWE-345
• CWE-863
• CWE-1188

• https://github.com/QuantumNous/new-api/releases/tag/v0.12.10Product, Release Notes
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4Exploit, Mitigation, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41427Better Auth is an authentication and authorization library f…6.5
• CVE-2026-41428Budibase is an open-source low-code platform. Prior to 3.35.…9.1
• CVE-2026-41429arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.8
• CVE-2026-4143The Neos Connector for Fakturama plugin for WordPress is vul…4.3
• CVE-2026-41430Press, a Frappe custom app that runs Frappe Cloud, manages i…6.1
• CVE-2026-41431Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browse…8
• CVE-2026-41433OpenTelemetry eBPF Instrumentation provides eBPF instrumenta…8.4
• CVE-2026-41434OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41445KissFFT before commit 8a8e66e contains an integer overflow v…8.8
• CVE-2026-41446Snap One WattBox 800 and 820 series firmware versions prior …9.8
• CVE-2026-41447FirmaCheck for Windows before 1.3.16 contains a DLL hijackin…8.5
• CVE-2026-41448AdGuard Home, when started with the --glinet flag, contains …9.4