CVE-2026-7643: ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7643?
CVE-2026-7643 is classified as a moderate severity vulnerability impacting cross-domain policy.
How do I fix CVE-2026-7643?
To mitigate CVE-2026-7643, upgrade ChatGPTNextWeb NextChat to version 2.16.2 or later.
What are the potential risks associated with CVE-2026-7643?
CVE-2026-7643 can lead to an insecure cross-domain policy, potentially exposing sensitive data to untrusted domains.
What component is affected by CVE-2026-7643?
CVE-2026-7643 affects the API Endpoint component of NextChat in ChatGPTNextWeb software.
In which versions of ChatGPTNextWeb NextChat is CVE-2026-7643 present?
CVE-2026-7643 affects all versions of ChatGPTNextWeb NextChat up to and including version 2.16.1.