NextChat versions 2.15.8 through 2.16.1 have an improper URL validation flaw in the proxy endpoint. The x-base-url header is validated by substring matching rather than proper hostname parsing, so any URL containing the string "api.openai.com" is accepted. The server then forwards its Authorization header, which holds the OpenAI API key, back to the requestor. The result is a direct leakage of the server’s OpenAI key, enabling an attacker to perform authorized requests, incur costs, or exfiltrate data. This vulnerability is an example of CWE‑20, Improper Input Validation.

The affected system is the ChatGPTNextWeb:NextChat application, specifically versions 2.15.8 through 2.16.1. These releases expose a proxy endpoint that accepts the x‑base‑url header and is vulnerable to the described validation error.

The CVSS score of 8.7 classifies this flaw as high severity; the EPSS score is not available, and it is not listed in the CISA KEV catalog. Remote attackers can exploit the flaw by sending a crafted request to the proxy endpoint with a malicious x‑base‑url header. No privileges or user interaction are required on the target system. Once the key is exposed, an attacker can impersonate the server’s OpenAI account, potentially causing financial loss and data leakage.