CVE-2026-41432CWE-1188CWE-345CWE-863

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

High · published May 8, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00751 · 54.5th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-345 · Insufficient Verification of Data Authenticity; CWE-863 · Incorrect Authorization
Published
2026-05-08T22:21Z
EPSS history
Timeline
  • 08 MAY 22:21Z
    New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
    cvelistv5