---
id: CVE-2026-44342
aliases:
  - GHSA-26v7-h57m-gh9m
title: New API is vulnerable to CSRF through user email binding
summary: New API is vulnerable to CSRF through user email binding
severity: medium
cvss: 5.3
cwe:
  - CWE-352
vendor: QuantumNous
product: github.com/QuantumNous/new-api
ecosystem: go
affected:
  - github.com/QuantumNous/new-api < 0.12.0-alpha.1
patched:
  - github.com/QuantumNous/new-api 0.12.0-alpha.1
published: '2026-07-07'
updated: '2026-07-07'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-26v7-h57m-gh9m'
references:
  - url: >-
      https://github.com/QuantumNous/new-api/security/advisories/GHSA-26v7-h57m-gh9m
  - url: >-
      https://github.com/QuantumNous/new-api/commit/e099117c61391abdf888fb75e382a582e550bd0e
  - url: 'https://github.com/advisories/GHSA-26v7-h57m-gh9m'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-07T13:53:11.864Z'
epss: 0.00191
epssPercentile: 0.07826
---

## Overview

## Summary

The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.

Affected endpoints included:

- `GET /api/oauth/email/bind`
- `GET /api/oauth/wechat/bind`

## Impact

A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses `SameSite=Strict`, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.

## Affected versions

Versions before `v0.12.0-alpha.1` are affected.

## Patches

This issue is fixed in `v0.12.0-alpha.1`. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.

## Workarounds

If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to `/api/oauth/email/bind` and `/api/oauth/wechat/bind` at the reverse proxy.

## Resources

- Fixed by commit `e099117c61391abdf888fb75e382a582e550bd0e`.
- Relevant code paths: `router/api-router.go` and `controller/user.go`.

## Affected packages

- `github.com/QuantumNous/new-api < 0.12.0-alpha.1`

## Remediation

Upgrade to a patched release:

- `github.com/QuantumNous/new-api 0.12.0-alpha.1`