{"data":{"id":"a1361030-9b37-43cd-a5ab-6743aabc8eba","title":"CVE-2026-7643: A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of…","summary":"CVE-2026-7643 affects ChatGPTNextWeb NextChat up to 2.16.1, specifically an unknown function of the file Next.js in the API Endpoint component. Manipulating it can lead to a permissive cross-domain policy that trusts untrusted domains, and the attack may be launched remotely. The exploit has been published and may be used, and the project was informed through an issue report but has not responded yet.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7643","publishedAt":"2026-05-02T15:16:14.203Z","cveId":"CVE-2026-7643","cweIds":["CWE-346","CWE-942"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ChatGPTNextWeb NextChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChatGPTNextWeb NextChat permissive cross-domain policy via API endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00158,"epssCheckedAt":"2026-11-09T18:09:53.615Z","kevDateAdded":null,"advisoryAliases":["GHSA-cv87-px3c-7h2j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:15.128Z","patchAvailable":null,"disclosureDate":"2026-05-02T15:16:14.203Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}