by Kastro
Paper/Archive/CVE-2026-71479

CVE-2026-71479

QuantumNous new-api — New API: Integer overflow in quota billing yields negative charges (self-crediting)

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.0.510 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

Affected

ProductAffectedFixed inSource
new-api< 1.0.0-rc.18–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/QuantumNous/new-api/security/advisories/GHSA-8r8v-xf7q-rcprrefgithub.com/QuantumNous/new-api/commit/c9943d37ad93477dd937fc4901cc3c4e0fd8aaabrefgithub.com/QuantumNous/new-api/commit/d0bd8aac742d1e160a5ca61743fe35f4fff880e8refgithub.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.18