CVE-2026-82639 | BDVDB-2026-366367 Detail

Description#

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-30Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.