CyberRota Analysis
AI-GeneratedThe vulnerability affects the New API's account binding endpoints, which improperly utilize GET requests for state-changing operations, allowing attackers to bind their own email addresses or OAuth identities to a logged-in user's account. This could lead to unauthorized access and account takeover in environments where session cookies are exposed to cross-site navigations. Organizations using versions prior to 0.12.0-alpha.1 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)