PT-2026-35034 · Go+4 · Github.Com/Quantumnous/New-Api+2

Changeyu0229

·

CVE-2026-41432

·

Published

2026-04-24

·

Updated

2026-07-30

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions New API versions prior to 0.12.10
Description A flaw in the Stripe webhook handler allows unauthenticated attackers to forge webhook events and credit arbitrary quota to their accounts without payment. This is caused by three issues: the system does not reject requests when StripeWebhookSecret is empty (the default), allowing attackers to compute valid signatures; the sessionCompleted handler fails to verify that payment status is set to paid; and the Recharge() function does not validate that the order's PaymentMethod matches the callback source, enabling cross-gateway exploitation where orders from other payment methods can be fulfilled via a forged Stripe webhook.
Technical details include:
  • API Endpoint: '/api/stripe/webhook'
  • Vulnerable Variables: StripeWebhookSecret
  • Vulnerable Functions: StripeWebhook(), sessionCompleted(), and Recharge()
Recommendations Update to version 0.12.10. As a temporary workaround, set StripeWebhookSecret to any non-empty value in the admin panel. If Stripe is not used, block access to the '/api/stripe/webhook' endpoint using a reverse proxy.

Exploit

Fix

Insufficient Verification of Data Authenticity

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-345CWE-863CWE-1188

Related Identifiers

CVE-2026-41432
GHSA-XFF3-5C9P-2MR4
GO-2026-5753
OPENSUSE-SU-2026:21483-1

Affected Products

Github.Com/Quantumnous/New-Api
Govulncheck-Vulndb
New Api