The flaw is an integer overflow in the quota‑billing calculations of the new‑api, where user supplied values for image size, video length, audio duration, token counts and billing expressions are converted without proper range checks. An attacker with a low‑privileged account that still holds a positive balance or an active subscription can craft requests that cause the server to generate a negative charge. Instead of a charge, the system credits the account, effectively turning negative billing into free credit and potentially draining upstream funds.

QuantumNous’s new‑api gateway remains vulnerable in all releases prior to 1.0.0-rc.18. The issue lives in the common/quota_math.go module and related settlement paths. Updating to version 1.0.0‑rc.18 or later patches the integer‑overflow bug and prevents the self‑crediting behaviour.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score is not available, but the financial incentive and ease of triggering an overflow by supplying large API parameters mean exploitation is likely. The flaw is not listed in CISA’s KEV catalog yet, and the attack vector requires only API interaction, allowing remote attackers to abuse the billing system.