What happened
NextChat's server-side LLM proxy accepted a spoofed base-URL header due to substring rather than proper hostname validation, allowing unauthenticated remote attackers to redirect the proxy's outbound request — and the API key it carries — to a server they control.
Why it matters
A single crafted HTTP request from an unauthenticated attacker fully exfiltrates the deployment's OpenAI billing credential, enabling account takeover, financial abuse, and data exposure of any prompts subsequently proxied through the attacker's endpoint.
Attack vector
The proxy endpoint validates the x-base-url header using substring matching instead of hostname parsing, so an unauthenticated attacker can submit a crafted x-base-url containing 'api.openai.com' that actually resolves to an attacker-controlled host, causing the server's Authorization header (carrying the OpenAI API key) to be sent to that host.
Affected systems
ChatGPTNextWeb NextChat versions 2.15.8 through 2.16.1
Mitigation
Upgrade NextChat past 2.16.1 (or apply hostname-exact-match validation); rotate any exposed OPENAI_API_KEY; restrict/disable the proxy route; use egress allowlisting.