{"data":{"id":"0d15f16c-f79e-4e50-9b26-e2d96a795839","title":"CVE-2026-82639: NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint…","summary":"NextChat versions 2.15.8 through 2.16.1 contain an improper URL validation flaw in the proxy endpoint. The x-base-url header is checked with substring matching rather than hostname parsing, so any URL containing 'api.openai.com' passes validation and receives the server's credentials in the Authorization header, allowing an attacker to obtain the server's OpenAI API key.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82639","publishedAt":"2026-08-30T14:17:03.750Z","cveId":"CVE-2026-82639","cweIds":["CWE-20"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["NextChat","OpenAI API"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"NextChat improper URL validation in proxy endpoint exposes OpenAI API key","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00508,"epssCheckedAt":"2026-11-04T18:09:13.788Z","kevDateAdded":null,"advisoryAliases":["GHSA-87fx-h8m6-gxwv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:08:52.628Z","patchAvailable":null,"disclosureDate":"2026-08-30T14:17:03.750Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[]}}