Critical Flaw in NewAPI System Exposes Unsecured Keys to Unlimited Free Use

AIbase Report, April 16, 2026 — The widely used AI large-model interface aggregation and management system QuantumNous/new-api (commonly known as NewAPI), popular in open-source communities and among self-hosted site administrators, has been confirmed to contain a high-risk vulnerability in its payment logic. When the Stripe payment key is not properly configured, attackers can forge Webhook events to bypass the actual payment process, enabling "zero-cost" recharges of arbitrary amounts.

The attack methodology and mitigation strategies for this vulnerability have sparked extensive discussion on developer forums and public technical communities like X (formerly Twitter). Given that the system is often used for commercial operations or token-based billing, the discoverer has temporarily withheld the full proof-of-concept exploit code (PoC) to prevent malicious exploitation and potential financial losses.

Vulnerability Principle Analysis

NewAPI is a management system that handles intermediate processing, billing, and recharge functions for large-model interfaces such as OpenAI and Claude. The core of the exposed vulnerability lies in its failure to rigorously validate empty Stripe keys within the payment success callback (asynchronous Webhook processing logic).

Based on attack flow analysis circulating in technical communities, when the server-side Stripe webhook_secret is not configured (i.e., left as an empty string), it creates a critical trust breakdown:

Signature Mechanism Failure: The HMAC-SHA256 algorithm does not generate an error when processing an empty key. This allows any attacker to compute a forged signature that perfectly matches the server's validation logic for a custom payload.

Constructing a Malicious Event: Attackers only need to obtain or guess the order number format to forge a checkout.session.completed event and set an arbitrarily high amount_total (recharge amount) in the data packet.

Funds Credited Without Actual Payment: After sending the forged request to the server's Webhook endpoint, the server validates the signature using the empty key. Upon successful validation, the system incorrectly treats it as a legitimate paid order and credits the attacker's account balance.

The Final Outcome: Stripe receives $0, and no transaction records appear in the official Stripe dashboard. However, the server logs show normal Webhook callbacks, and the attacker's account balance is successfully increased.

Vulnerability Impact Scope

This vulnerability only affects instances where the Stripe Secret Key is not properly configured. Many administrators overlook configuring this key when setting up test environments or when their sites primarily rely on other payment methods (such as WeChat or Alipay) and do not use the Stripe module, leaving them highly vulnerable.

Official Fix and Recommendations

In response to this serious security risk, the project team acted swiftly and released the latest v0.12.10 version today. The update log clearly indicates the fix direction: “Improved Stripe payment processing to better handle asynchronous webhook events,” addressing the security blind spot in callback verification at a fundamental level.

Security experts strongly recommend all NewAPI users take the following actions:

Upgrade Immediately: Update your instance to the latest v0.12.10 or a higher version (it is recommended to directly pull the latest release or nightly build).

Enforce Key Configuration: Even if your site does not plan to use Stripe payments, after upgrading, you must configure the Stripe Secret Key in the backend. It is recommended to use a randomly generated strong password string or strictly control it via environment variables to eliminate the possibility of an empty key.

Conduct a Billing Self-Audit: Immediately review existing user orders and recharge records within the system (especially in test environments), cross-reference them with actual funds received, and check for any fraudulent high-value recharges.

Improve Payment Authentication: For production environments, it is recommended to thoroughly review the asynchronous callback logic for all payment channels to ensure dual verification of both signature validity and order status authenticity.

The technical details of this vulnerability are now public. Due to its relatively low exploitation barrier, it is recommended that all relevant administrators take immediate action to perform self-inspections and upgrades to prevent potential digital asset losses.