Improper URL Validation in NextChat Proxy Endpoint

NextChat versions 2.15.8 through 2.16.1 contain an improper URL validation vulnerability located within the application's proxy endpoint. The flaw stems from the application utilizing weak substring matching rather than proper hostname parsing when validating the 'x-base-url' HTTP header.

An attacker can leverage this logic error by providing a crafted URL that contains the string 'api.openai.com' as a substring. This bypasses the intended security controls, causing the NextChat server to route requests to an attacker-controlled destination while including the server's sensitive OpenAI API key within the Authorization header. This vulnerability enables unauthorized access to and potential exfiltration of the organization's OpenAI API credentials.