https://feed.craftedsignal.io/vendors/nextchat/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 30 Aug 2026 17:11:12 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-08-nextchat-url-validation/Sun, 30 Aug 2026 17:11:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-nextchat-url-validation/NextChat versions 2.15.8 through 2.16.1 are vulnerable to credential theft due to weak URL validation in the proxy endpoint, allowing attackers to exfiltrate the server's OpenAI API key.<p>NextChat versions 2.15.8 through 2.16.1 contain an improper URL validation vulnerability located within the application's proxy endpoint. The flaw stems from the application utilizing weak substring matching rather than proper hostname parsing when validating the 'x-base-url' HTTP header.</p> <p>An attacker can leverage this logic error by providing a crafted URL that contains the string 'api.openai.com' as a substring. This bypasses the intended security controls, causing the NextChat server to route requests to an attacker-controlled destination while including the server's sensitive OpenAI API key within the Authorization header. This vulnerability enables unauthorized access to and potential exfiltration of the organization's OpenAI API credentials.</p> highadvisory