The vulnerability is a classic CSRF flaw (CWE‑352) caused by the use of GET requests for state‑changing account‑binding operations on the endpoints /api/oauth/email/bind and /api/oauth/wechat/bind. An attacker can craft a link or embed a hidden image that, when a victim’s authenticated browser follows it, causes the victim’s account to be bound to an email address or WeChat identity controlled by the attacker. This results in the attacker gaining the ability to authenticate to the victim’s account or to carry out further malicious actions under the victim’s identity if the system allows account recovery via the bound email or WeChat identity.

The flaw exists in the QuantumNous new‑api product. Any deployment running a version prior to 0.12.0‑alpha.1 is vulnerable. Versions 0.12.0‑alpha.1 and later contain the fix.

With a CVSS score of 5.3, the flaw is considered medium severity. EPSS is < 1% and the vulnerability is not listed in CISA KEV. The likely attack vector is through a cross‑site request sent from a malicious page to the target’s authenticated session. Successful exploitation requires only that the victim is logged in and that the browser automatically sends the session cookie during the navigation. Once exploited, the attacker can bind an alternate email or WeChat identity to the victim’s account, enabling account takeover or unauthorized access.