Do Son 
TL;DR
A billing flaw in New API, a popular open-source AI API gateway, is under active attack. Tracked as CVE-2026-71479, this integer overflow lets a user with a small balance credit themselves an enormous one. The maintainers confirmed exploitation in the wild and shipped an emergency fix. The flaw scores a CVSS 9.1.
- CVE: CVE-2026-71479
- CVSS: 9.1 (Critical · CVSSv3)
- Product: github.com/QuantumNous/new-api (go)
- Affected: <= 1.0.0-rc.17
- Impact: New API: Integer overflow in quota billing yields negative charges (self-crediting)
- Status: Exploited in the wild
- Patched in: 1.0.0-rc.18
- Action: Update to 1.0.0-rc.18 now
Why It Matters
New API handles billing and quota for AI applications. This CVE-2026-71479 integer overflow breaks that billing integrity. A single crafted request can turn a tiny balance into a huge one.
The impact is not just free usage. Sustained abuse can drain an operator’s prepaid upstream funds. It can also knock billing and service offline. The project has over 45,000 GitHub stars, which signals wide deployment.
Confirmed Exploitation
On July 6, 2026, a community operator reported active abuse. Their logs showed large negative charges and wildly inflated balances. The maintainers confirmed the attack and responded within hours. The official New API security advisory documents the full timeline.
How the Attack Works
Several billing paths multiply a user-controlled quantity into the quota math. That math lacked an upper bound and overflow-safe conversion. An attacker supplies an extreme value, such as a huge image count.
A unsigned field accepts that wrapped value. The conversion then overflows past the integer range into a large negative number. This negative quota takes effect at settlement, not at pre-consume. As a result, the charge flips negative and credits the balance.
The pre-consume gate blocks zero-balance accounts, so the attacker needs a small positive balance first. However, free check-in rewards, invite rebates, or new-user gifts can supply that seed at no cost. With self-registration on, mass abuse becomes easy. This report omits any working exploit values.
Affected Versions
The flaw affects New API versions up to and including 1.0.0-rc.17. The maintainers rate it critical, with a CVSS score of 9.1 and a CWE-190 integer overflow classification.
Patch and Mitigation Steps
Upgrade to version 1.0.0-rc.18 or later without delay. Version 1.0.0-rc.19 adds quota-saturation warning logs for easier auditing.
After patching, review logs for negative consumption entries. You should also audit accounts with abnormally inflated balances and correct them. Pay close attention to accounts that mass-registered while free-balance features were enabled. Freeze or reclaim any balances that grew through this abuse.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
