Description

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-30T14:17:03.750Z",
  "pubdate": "2026-08-30T14:17:03.750Z",
  "executiveSummary": "NextChat versions 2.15.8 through 2.16.1 are affected by an improper URL validation vulnerability within the application's proxy endpoint.\nThe vulnerability originates from flawed input sanitization logic that relies on substring matching rather than rigorous URI parsing when processing the 'x-base-url' header.\nThis architectural oversight enables unauthorized actors to perform Server-Side Request Forgery (SSRF) or redirect proxy traffic to attacker-controlled infrastructure.\nBy bypassing the validation check, an attacker can coerce the application into forwarding the server's legitimate OpenAI API key to a malicious endpoint embedded in the 'Authorization' header.\nThe risk implication is critical, as it facilitates the exfiltration of sensitive service credentials, leading to potential financial loss and unauthorized access to the underlying OpenAI service account.\nExploitation requires no prior authentication and can be performed remotely by any actor capable of interacting with the proxy endpoint of an affected instance.",
  "technicalDetails": "The vulnerability resides within the proxy functionality of the NextChat application, specifically in how the system validates the 'x-base-url' HTTP header provided by a client.\nThe root cause is a deficiency in the input validation mechanism, which employs a substring matching check to verify the destination URL. Instead of utilizing a robust URI parsing library to decompose the URL into its constituent parts—such as scheme, host, port, and path—the implementation merely checks if the string 'api.openai.com' exists anywhere within the provided value.\nThis logic is inherently flawed as it allows for trivial bypasses. An attacker can supply a malicious URL such as 'https://attacker.com/api.openai.com' or 'https://api.openai.com.attacker.com'. Because the substring 'api.openai.com' is present, the proxy validation logic incorrectly flags the URL as legitimate, allowing the request to proceed to the malicious destination.\nThe attack flow follows a specific sequence: First, the attacker identifies a vulnerable NextChat instance exposing a proxy endpoint. Second, the attacker crafts an HTTP request containing the 'x-base-url' header, setting it to a domain under their control while ensuring the 'api.openai.com' substring is included in the string. Third, the NextChat application, acting as an intermediary, injects the server's configured OpenAI API key into the 'Authorization' header of the request.\nFinally, the application forwards this modified request to the attacker-controlled server. Upon receipt, the attacker extracts the API key from the incoming request's 'Authorization' header. This effectively results in the compromise of the credentials intended for legitimate service interactions.\nThe exposure is network-based, meaning any NextChat instance reachable over the internet with the proxy feature enabled is susceptible to this credential theft. Because the validation occurs at the application level during the proxy handshake, the attack does not require any specific user privileges or prior authentication sessions with the NextChat instance itself.\nThe post-exploitation impact is severe, as the attacker gains the ability to masquerade as the legitimate NextChat server, allowing them to deplete existing API usage quotas, perform unauthorized operations under the compromised account, or further interrogate the target infrastructure if secondary internal vulnerabilities exist."
}