CVE-2026-41432

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

State: Published
Severity: 7.1 High
Published: May 8, 2026
Updated: May 12, 2026
Reserved: Apr 20, 2026

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L	GitHub_M

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity
CWE-1188 Insecure Default Initialization of Resource
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
new-apiQuantumNous	< 0.12.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.