GHSA-26v7-h57m-gh9m

Source

https://github.com/advisories/GHSA-26v7-h57m-gh9m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-26v7-h57m-gh9m/GHSA-26v7-h57m-gh9m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-26v7-h57m-gh9m

Aliases

Published

2026-07-07T13:01:49Z

Modified

2026-07-21T19:19:20Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

New API is vulnerable to CSRF through user email binding

Details

Summary

The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth identity.

Affected endpoints included:

GET /api/oauth/email/bind
GET /api/oauth/wechat/bind

Impact

A successful attack could change account binding state. For email binding, the attacker could bind an email address they control and then attempt follow-on account recovery flows. The default session cookie configuration uses SameSite=Strict, which mitigates common cross-site navigation attacks in modern browsers, so the issue is rated Medium.

Affected versions

Versions before v0.12.0-alpha.1 are affected.

Patches

This issue is fixed in v0.12.0-alpha.1. The fix changes email and WeChat binding routes from GET to POST and reads parameters from a JSON request body instead of query parameters. The same change set also normalizes password reset responses to avoid disclosing whether an email is registered.

Workarounds

If upgrading immediately is not possible, ensure session cookies are configured with strict SameSite behavior and block GET requests to /api/oauth/email/bind and /api/oauth/wechat/bind at the reverse proxy.

Resources

Fixed by commit e099117c61391abdf888fb75e382a582e550bd0e.
Relevant code paths: router/api-router.go and controller/user.go.

Database specific

{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-07T13:01:49Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/QuantumNous/new-api

Package

Name: github.com/QuantumNous/new-api; View open source insights on deps.dev
Purl: pkg:golang/github.com/QuantumNous/new-api

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0-alpha.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-26v7-h57m-gh9m/GHSA-26v7-h57m-gh9m.json"