CVE-2026-82639: proxy URL check bypass leaks OpenAI

CISO Take

NextChat's self-hosted proxy validates the destination for OpenAI-bound requests using a substring match on 'api.openai.com' rather than proper hostname parsing, so any attacker-controlled URL that merely contains that string (e.g. api.openai.com.evil.com) is accepted and gets the server's OpenAI Authorization header forwarded to it. This is a trivial, unauthenticated, network-reachable bypass (CVSS 7.5, AC:L, PR:N, UI:N) with no exploit code or Nuclei template published yet and no CISA KEV listing, but the flaw sits in a widely deployed open-source ChatGPT front-end that many teams self-host as an internal LLM gateway, meaning the blast radius depends entirely on how many instances are internet-facing. A successful hit hands the attacker your organization's OpenAI API key outright — enabling unbounded usage against your billing account and unauthorized access to any data or fine-tunes reachable with that credential. Upgrade past NextChat 2.16.1 immediately, and in the interim rotate any OpenAI keys used by self-hosted proxy deployments and restrict the proxy's egress/firewall rules so it cannot reach attacker-controlled hosts. Detection: audit OpenAI usage/billing dashboards for anomalous spend or unfamiliar request patterns, and review reverse-proxy/WAF logs for x-base-url headers containing unexpected hostnames.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

High-severity, network-exploitable, unauthenticated confidentiality-only flaw (CVSS 7.5, C:H/I:N/A:N). Exploitation requires no special skill — just crafting a URL string that contains the expected substring — making sophistication trivial and attack complexity low. No EPSS score, CISA KEV listing, public exploit, or Nuclei template currently exist, so there is no evidence of active mass exploitation, but the simplicity of the bypass means opportunistic scanning against exposed NextChat instances is plausible once the advisory circulates. Real-world risk is proportional to how many organizations run internet-facing NextChat proxies with live OpenAI credentials attached.

How does the attack unfold?

Recon

Attacker identifies a publicly exposed NextChat proxy endpoint accepting an x-base-url header for OpenAI-bound requests.

AML.T0006

Validation bypass

Attacker sends a request with x-base-url set to an attacker-controlled domain that merely contains the substring 'api.openai.com', passing NextChat's flawed check.

AML.T0049

Credential exfiltration

The proxy forwards the request, including the server's OpenAI Authorization header, to the attacker's domain, where the key is captured.

Impact

Attacker reuses the stolen OpenAI API key for unauthorized inference access and cost abuse against the victim's account.

AML.T0040

Recon

Attacker identifies a publicly exposed NextChat proxy endpoint accepting an x-base-url header for OpenAI-bound requests.

AML.T0006

Validation bypass

Attacker sends a request with x-base-url set to an attacker-controlled domain that merely contains the substring 'api.openai.com', passing NextChat's flawed check.

AML.T0049

Credential exfiltration

The proxy forwards the request, including the server's OpenAI Authorization header, to the attacker's domain, where the key is captured.

Impact

Attacker reuses the stolen OpenAI API key for unauthorized inference access and cost abuse against the victim's account.

AML.T0040

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade NextChat past 2.16.1 once a patched release enforcing strict hostname parsing (exact-match or proper URL.hostname comparison, not substring matching) is available — track https://github.com/ChatGPTNextWeb/NextChat/issues/6814. 2) If patching isn't immediately possible, front the proxy with a WAF/reverse-proxy rule that rejects x-base-url values not exactly matching 'api.openai.com'. 3) Rotate the OpenAI API key used by any exposed NextChat instance and set spend/usage alerts on the OpenAI billing dashboard. 4) Restrict egress from the proxy host so it can only reach api.openai.com, not arbitrary attacker infrastructure. 5) Review historical proxy logs for x-base-url headers containing unexpected hostnames as an indicator of prior exploitation.

How is it classified?

Data Leakage Auth Bypass API Framework AML.T0012 - Valid Accounts AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-82639?

NextChat's self-hosted proxy validates the destination for OpenAI-bound requests using a substring match on 'api.openai.com' rather than proper hostname parsing, so any attacker-controlled URL that merely contains that string (e.g. api.openai.com.evil.com) is accepted and gets the server's OpenAI Authorization header forwarded to it. This is a trivial, unauthenticated, network-reachable bypass (CVSS 7.5, AC:L, PR:N, UI:N) with no exploit code or Nuclei template published yet and no CISA KEV listing, but the flaw sits in a widely deployed open-source ChatGPT front-end that many teams self-host as an internal LLM gateway, meaning the blast radius depends entirely on how many instances are internet-facing. A successful hit hands the attacker your organization's OpenAI API key outright — enabling unbounded usage against your billing account and unauthorized access to any data or fine-tunes reachable with that credential. Upgrade past NextChat 2.16.1 immediately, and in the interim rotate any OpenAI keys used by self-hosted proxy deployments and restrict the proxy's egress/firewall rules so it cannot reach attacker-controlled hosts. Detection: audit OpenAI usage/billing dashboards for anomalous spend or unfamiliar request patterns, and review reverse-proxy/WAF logs for x-base-url headers containing unexpected hostnames.

Is CVE-2026-82639 actively exploited?

No confirmed active exploitation of CVE-2026-82639 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-82639?

1) Upgrade NextChat past 2.16.1 once a patched release enforcing strict hostname parsing (exact-match or proper URL.hostname comparison, not substring matching) is available — track https://github.com/ChatGPTNextWeb/NextChat/issues/6814. 2) If patching isn't immediately possible, front the proxy with a WAF/reverse-proxy rule that rejects x-base-url values not exactly matching 'api.openai.com'. 3) Rotate the OpenAI API key used by any exposed NextChat instance and set spend/usage alerts on the OpenAI billing dashboard. 4) Restrict egress from the proxy host so it can only reach api.openai.com, not arbitrary attacker infrastructure. 5) Review historical proxy logs for x-base-url headers containing unexpected hostnames as an indicator of prior exploitation.

What systems are affected by CVE-2026-82639?

This vulnerability affects the following AI/ML architecture patterns: LLM API proxy/gateway, self-hosted chat UI deployments.

What is the CVSS score for CVE-2026-82639?

CVE-2026-82639 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

LLM API proxy/gatewayself-hosted chat UI deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

Exploitation Scenario

An attacker discovers a publicly reachable NextChat proxy endpoint (common in self-hosted deployments meant only for internal use but left exposed). They send a request to the proxy with the header 'x-base-url: https://api.openai.com.attacker-controlled.com', which passes NextChat's flawed substring check because it contains 'api.openai.com'. The proxy forwards the request — including the server's OpenAI Authorization header — to the attacker's domain instead of the real OpenAI API. The attacker's server logs the captured API key and subsequently uses it directly against the real OpenAI API to run unauthorized inference, drive up billing, or access any account-level resources tied to that key.

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.