What happened
CVE-2026-71479 (CVSS 9.1 Critical) is an integer overflow in New API's billing/quota calculation logic. A community operator reported active abuse on 2026-07-06 showing wildly inflated balances and negative consumption entries; maintainers confirmed in-the-wild exploitation and shipped an emergency fix. The project has tens of thousands of GitHub stars, indicating broad deployment as a self-hosted OpenAI-compatible gateway.
Why it matters
New API sits in front of upstream LLM providers as a billing/access-control layer; a single crafted request can drain an operator's prepaid upstream model-provider funds or take down billing/service entirely, directly threatening the economics of AI API operations at scale.
Attack vector
User-controlled quantity fields (image count n, video seconds/duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) are multiplied into quota/settlement math in common/quota_math.go without bounds checking, causing integer overflow (CWE-190) that converts a negative charge into a large positive account credit.
Affected systems
New API (QuantumNous/new-api), an open-source LLM gateway and AI asset-management system, versions prior to 1.0.0-rc.18
Mitigation
Upgrade to New API >= 1.0.0-rc.18; audit and reconcile anomalous account balances, quotas, and settlement records for signs of abuse.