CVE-2026-44342: New API is vulnerable to CSRF through user email binding

July 7, 2026

The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user’s browser to bind an attacker-controlled email address or OAuth identity.

Affected endpoints included:

GET /api/oauth/email/bind
GET /api/oauth/wechat/bind

References

github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e
github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m
github.com/advisories/GHSA-26v7-h57m-gh9m
nvd.nist.gov/vuln/detail/CVE-2026-44342

Code Behaviors & Features

Detect and mitigate CVE-2026-44342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →