CVE-2026-82639 — NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. …
Published: 2026-08-30 · CVSS: 8.7 · CVSS 4.0
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7