{"id":"CVE-2026-44342","aliases":["GHSA-26v7-h57m-gh9m"],"title":"New API is vulnerable to CSRF through user email binding","summary":"New API is vulnerable to CSRF through user email binding","severity":"medium","cvss":5.3,"cwe":["CWE-352"],"vendor":"QuantumNous","product":"github.com/QuantumNous/new-api","ecosystem":"go","affected":["github.com/QuantumNous/new-api < 0.12.0-alpha.1"],"patched":["github.com/QuantumNous/new-api 0.12.0-alpha.1"],"published":"2026-07-07","updated":"2026-07-07","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-26v7-h57m-gh9m","references":[{"url":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m"},{"url":"https://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e"},{"url":"https://github.com/advisories/GHSA-26v7-h57m-gh9m"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-07T13:53:11.864Z","epss":0.00191,"epssPercentile":0.09065,"slug":"CVE-2026-44342","body":"## Overview\n\n## Summary\n\nThe email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.\n\nAffected endpoints included:\n\n- `GET /api/oauth/email/bind`\n- `GET /api/oauth/wechat/bind`\n\n## Impact\n\nA successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses `SameSite=Strict`, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.\n\n## Affected versions\n\nVersions before `v0.12.0-alpha.1` are affected.\n\n## Patches\n\nThis issue is fixed in `v0.12.0-alpha.1`. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.\n\n## Workarounds\n\nIf upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to `/api/oauth/email/bind` and `/api/oauth/wechat/bind` at the reverse proxy.\n\n## Resources\n\n- Fixed by commit `e099117c61391abdf888fb75e382a582e550bd0e`.\n- Relevant code paths: `router/api-router.go` and `controller/user.go`.\n\n## Affected packages\n\n- `github.com/QuantumNous/new-api < 0.12.0-alpha.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/QuantumNous/new-api 0.12.0-alpha.1`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}