CVE-2026-73079: Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0

Sub2API is a platform that manages API access (the ability to use AI services) by distributing shared accounts across multiple users. In versions 0.1.135 to 0.1.168, an authenticated user could manipulate the URL path to send requests to unintended servers using the platform's shared account credentials, because the system didn't validate where requests were being sent. This vulnerability was caused by path traversal (exploiting how the system handles file/URL paths without checking them).