{"id":"CVE-2025-62155","published":"2025-11-24T23:56:52Z","modified":"2025-11-25T19:30:37Z","title":"QuantumNous New API Has SSRF Bypass","vendor":"QuantumNous","product":"new-api","tier":"tail","description":{"text":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.\nBecause the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00299,"percentile":0.22564,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4","tags":["x_refsource_CONFIRM"]}],"priority":{"score":10.5,"factors":[{"name":"EPSS percentile","points":4.51},{"name":"CVSS severity","points":5.95}]},"vendorSlug":"quantumnous","affectedVersions":[{"vendor":"QuantumNous","product":"new-api","versions":["< 0.9.6"]}],"affected":[{"ecosystem":"Go","package":"github.com/QuantumNous/new-api","vulnerableRanges":["<0.9.6","all versions"],"patched":["0.9.6"],"from":["GHSA-9f46-w24h-69w4","GO-2025-4154"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-198983","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-quantumnous-new-api-cve-2025-59146","children":[{"from":"CVE-2025-62155","to":"CVE-2026-42339","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified address 0.0.0.0.","from":"CVE.org","in":"CVE-2026-42339"},{"kind":"osv-related","provenance":"source","id":"GHSA-v5c3-6wvc-pc2q","via":"reference","url":"https://github.com/advisories/GHSA-9f46-w24h-69w4"},{"kind":"osv-related","provenance":"source","id":"GO-2026-5652","via":"reference","url":"https://github.com/advisories/GHSA-9f46-w24h-69w4"}]}]}}