CVE-2026-44342: New API CSRF in email and WeChat account binding endpoints
Summary
The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.
Affected endpoints included:
- GET /api/oauth/email/bind - GET /api/oauth/wechat/bind
Impact
A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses SameSite=Strict, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.
Affected versions
Versions before v0.12.0-alpha.1 are affected.
Patches
This issue is fixed in v0.12.0-alpha.1. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.
Workarounds
If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to /api/oauth/email/bind and /api/oauth/wechat/bind at the reverse proxy.
Resources
- Fixed by commit e099117c61391abdf888fb75e382a582e550bd0e. - Relevant code paths: router/api-router.go and controller/user.go.
Other sources
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing an attacker to trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity in deployments where session cookies could be sent on cross-site navigations. This issue is fixed in version 0.12.0-alpha.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/QuantumNous/new-apito a version that resolves this vulnerability.Fixed in 0.12.0-alpha.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.12.0-alpha.1Patch e099117c61391abdf888fb75e382a582e550bd0e - Configuration
If upgrading immediately is not possible, block GET requests to /api/oauth/email/bind and /api/oauth/wechat/bind at the reverse proxy.
Reverse proxy Block GET requests = /api/oauth/email/bind and /api/oauth/wechat/bind - Configuration
Ensure session cookies are configured with strict SameSite behavior (default is SameSite=Strict per the report) to mitigate cross-site navigation abuse of the binding endpoints.
Session cookies SameSite = Strict
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44342?
The severity of CVE-2026-44342 is medium, rated at 5.3.
What type of vulnerability is CVE-2026-44342?
CVE-2026-44342 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2026-44342?
To fix CVE-2026-44342, ensure that state-changing operations do not rely on GET requests and implement CSRF protections.
What can attackers do with CVE-2026-44342?
Attackers can exploit CVE-2026-44342 to bind an attacker-controlled email address or OAuth token to a logged-in user's account.
Which software is affected by CVE-2026-44342?
CVE-2026-44342 affects the software found at go/github.com/QuantumNous/new-api.