CVE-2026-82639
NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 30, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 30, 2026
Description
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
NextChatChatGPTNextWeb |
|
References
- GitHub Issue #6814issue-tracking
- https://github.com/ChatGPTNextWeb/NextChatproduct
- https://github.com/ChatGPTNextWeb/NextChat/blob/v2.16.1/app/api/proxy.tstechnical-description
- VulnCheck Advisory: NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.