Technical impact
The vulnerability in the Stripe webhook handler of the New API allows an attacker to forge webhook events by exploiting an empty secret configuration. This flaw bypasses the signature verification step that Stripe normally uses to authenticate event data. As a result, a malicious actor can submit crafted webhook payloads that credit arbitrary amounts of quota to their account without any payment, effectively creating a fraud mechanism that increases resources at zero cost. The compromised system treats these forged notifications as legitimate, leading to a direct integrity violation and potential denial of service through resource exhaustion.
Affected Systems
The affected product is QuantumNous new-api. All versions prior to v0.12.10 are vulnerable. Version v0.12.10 and later contain the patch that enforces proper secret validation and signature verification.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity. Although there is no EPSS score available, the lack of authentication for the webhook endpoint and the trivial requirement of supplying a crafted payload means the attack can be executed by any external actor with internet access. The vulnerability is not listed in CISA KEV, but the ease of exploitation and lack of defensive checks make it a significant risk. The likely attack vector is an unauthenticated HTTP request to the webhook endpoint, with a forged payload and an empty or missing secret.
Github GHSA