CVE-2026-44342: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET

mediumCVSS 5.3CVE-2026-44342

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 5.3
Published: 2026-07-09
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-44342

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-443420.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-44342	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumGHSA-26v7-h57m-gh9m: New API is vulnerable to CSRF through user email bindingghsa

Recent advisories for New API is

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-33655: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset manageme…nvd · 2026-07-09
mediumGHSA-26v7-h57m-gh9m: New API is vulnerable to CSRF through user email bindingghsa · 2026-07-07
highGHSA-6qcr-qxgr-m7fv: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsghsa · 2026-07-07
low[NEW] [low] WSO2 API Manager: Vulnerability allows information disclosurecert-bund · 2026-07-06