Cve-2026-64859 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-64859/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 18:45:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInteger Overflow in New-API Billing Settlementhttps://feed.craftedsignal.io/briefs/2026-08-integer-overflow-billing/Mon, 17 Aug 2026 18:45:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-integer-overflow-billing/A critical integer overflow vulnerability in QuantumNous new-api allows authenticated users to inflate their account balance by injecting extreme quantity multipliers that result in negative settlement charges.The vulnerability CVE-2026-71479 affects the billing settlement logic in QuantumNous new-api versions 1.0.0-rc.17 and earlier. It stems from the application's failure to validate user-controlled quantity parameters, such as image counts or duration multipliers, before performing mathematical operations. By providing an extremely large numeric input that exceeds standard signed integer limits, an attacker triggers an overflow during type conversion (e.g., float64 to int64). This causes the settlement logic to calculate a massive negative cost for the transaction. Because the application treats this negative charge as a credit, the user's account balance is inflated instantly. This flaw is particularly dangerous for deployments with enabled self-registration or free sign-up bonuses, as it allows unauthenticated or low-privilege actors to gain and inflate seed balances, leading to the exhaustion of operator-prepaid upstream service funds.

Attack Chain

  1. Attacker performs account registration (if registration is enabled) or gains initial access to an account with a positive balance.
  2. Attacker crafts a standard request to the billing-related API endpoint, including an extremely high integer value (e.g., 18446744073686646784) in the quantity parameter field.
  3. The application's pre-consume check validates that the user has a sufficient balance for the request's nominal cost and permits the request to proceed.
  4. The request payload is processed by the backend, bypassing input validation as the integer overflow check is missing at the ingress level.
  5. The settlement module performs a mathematical operation (e.g., quota * quantity) using the uncontrolled, massive input.
  6. The integer conversion wraps the calculation into a large negative value due to the absence of saturation logic or bounds checks.
  7. The system registers the negative charge as a balance credit, updating the user's wallet with an inflated value.
  8. Attacker repeats the process to drain upstream service funds or sell inflated quota balances.

Impact

The vulnerability has been exploited in the wild, leading to massive unauthorized balance inflation and potential financial depletion of service providers. Attackers can leverage this to gain effectively unlimited API usage credits by mass-registering accounts that receive starter bonuses and then exploiting the overflow. Successful exploitation renders billing integrity void and risks the total loss of prepaid upstream funds.

Recommendation

  1. Upgrade to QuantumNous new-api version v1.0.0-rc.18 or later to implement required integer bounds checking and saturating math.
  2. Implement request ingress validation to reject quantity parameters exceeding established architectural limits (400 Bad Request).
  3. Monitor administrator audit logs for unusual quota saturation warnings related to CVE-2026-71479.
  4. Audit historical user transaction logs for negative charge entries or abnormally high balance shifts consistent with the reported exploitation.
]]>criticalthreatprivilege-escalationinformation-disclosurecve-2026-64859denial-of-serviceweb-applicationcve-2026-64868