CVE-2026-44342: New API is vulnerable to CSRF through user email binding

July 7, 2026

The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user’s browser to bind an attacker-controlled email address or OAuth identity.

Affected endpoints included:

GET /api/oauth/email/bind
GET /api/oauth/wechat/bind

References

github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e
github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m
github.com/advisories/GHSA-26v7-h57m-gh9m
nvd.nist.gov/vuln/detail/CVE-2026-44342

Code Behaviors & Features

Detect and mitigate CVE-2026-44342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →