{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/quantumnous/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["QuantumNous"],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-71479"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["new-api (\u003c= 1.0.0-rc.17)","new-api"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","information-disclosure","cve-2026-64859","denial-of-service","web-application","cve-2026-64868"],"_cs_type":"threat","_cs_vendors":["QuantumNous"],"content_html":"\u003cp\u003eThe vulnerability CVE-2026-71479 affects the billing settlement logic in QuantumNous new-api versions 1.0.0-rc.17 and earlier. It stems from the application's failure to validate user-controlled quantity parameters, such as image counts or duration multipliers, before performing mathematical operations. By providing an extremely large numeric input that exceeds standard signed integer limits, an attacker triggers an overflow during type conversion (e.g., float64 to int64). This causes the settlement logic to calculate a massive negative cost for the transaction. Because the application treats this negative charge as a credit, the user's account balance is inflated instantly. This flaw is particularly dangerous for deployments with enabled self-registration or free sign-up bonuses, as it allows unauthenticated or low-privilege actors to gain and inflate seed balances, leading to the exhaustion of operator-prepaid upstream service funds.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs account registration (if registration is enabled) or gains initial access to an account with a positive balance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a standard request to the billing-related API endpoint, including an extremely high integer value (e.g., 18446744073686646784) in the quantity parameter field.\u003c/li\u003e\n\u003cli\u003eThe application's pre-consume check validates that the user has a sufficient balance for the request's nominal cost and permits the request to proceed.\u003c/li\u003e\n\u003cli\u003eThe request payload is processed by the backend, bypassing input validation as the integer overflow check is missing at the ingress level.\u003c/li\u003e\n\u003cli\u003eThe settlement module performs a mathematical operation (e.g., quota * quantity) using the uncontrolled, massive input.\u003c/li\u003e\n\u003cli\u003eThe integer conversion wraps the calculation into a large negative value due to the absence of saturation logic or bounds checks.\u003c/li\u003e\n\u003cli\u003eThe system registers the negative charge as a balance credit, updating the user's wallet with an inflated value.\u003c/li\u003e\n\u003cli\u003eAttacker repeats the process to drain upstream service funds or sell inflated quota balances.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability has been exploited in the wild, leading to massive unauthorized balance inflation and potential financial depletion of service providers. Attackers can leverage this to gain effectively unlimited API usage credits by mass-registering accounts that receive starter bonuses and then exploiting the overflow. Successful exploitation renders billing integrity void and risks the total loss of prepaid upstream funds.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to QuantumNous new-api version v1.0.0-rc.18 or later to implement required integer bounds checking and saturating math.\u003c/li\u003e\n\u003cli\u003eImplement request ingress validation to reject quantity parameters exceeding established architectural limits (400 Bad Request).\u003c/li\u003e\n\u003cli\u003eMonitor administrator audit logs for unusual quota saturation warnings related to CVE-2026-71479.\u003c/li\u003e\n\u003cli\u003eAudit historical user transaction logs for negative charge entries or abnormally high balance shifts consistent with the reported exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-17T18:47:05Z","date_published":"2026-08-17T18:45:57Z","id":"https://feed.craftedsignal.io/briefs/2026-08-integer-overflow-billing/","summary":"A critical integer overflow vulnerability in QuantumNous new-api allows authenticated users to inflate their account balance by injecting extreme quantity multipliers that result in negative settlement charges.","title":"Integer Overflow in New-API Billing Settlement","url":"https://feed.craftedsignal.io/briefs/2026-08-integer-overflow-billing/"}],"language":"en","title":"CraftedSignal Threat Feed - QuantumNous","version":"https://jsonfeed.org/version/1.1"}