External risk intelligence

New API Billing Credit Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-71479

The product is identified as an LLM gateway and AI asset management system. By design, such services function as public-facing API endpoints or gateways to facilitate interactions with AI models, making them inherently exposed to network traffic in typical deployments.

Integer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects New API, an LLM gateway and AI asset management system. It could allow unauthorized manipulation of financial transactions, potentially leading to financial loss by converting charges into credits. The primary concern is confirming relevance and exposure to this system.

Allows manipulation of financial transactions.
Understand for potential financial implications.
Confirm relevance and system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the New API, which acts as an LLM gateway. These requests would manipulate image, video, token, and audio duration parameters. If successful, the overflow in the conversion process could allow a user with a positive balance or active subscription to convert charges into credits, potentially leading to the draining of funds.

No authentication required.
Malicious input to quantity parameters.
Financial fraud and fund draining.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, user-controlled quantities for image, video, tokens, and audio duration, along with billing expressions, could be manipulated through integer overflows. This could allow accounts with positive balances or active subscriptions to convert negative charges into account credit, potentially affecting upstream funds.

Financial assets and billing data at risk.
Negative charges converted to credit.
Upstream funds may be drained.

Operational Fix

Recommended remediation, mitigation, and detection steps

The New API LLM gateway and AI asset management system is likely managed by platform or application teams responsible for AI services. The first action should be to identify all instances of this system, confirm their exposure and business criticality, and then determine the accountable owner to plan remediation.

Platform or application teams should own this.
Verify all system instances and exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is New API?

New API is software designed to manage large language models (LLMs) and AI assets. It functions as a gateway, centralizing how applications interact with AI services, handling tasks like routing requests, managing access to models, and tracking usage quotas for billing and resource allocation.

What does CVE-2026-71479 mean for data integrity?

This CVE involves integer overflow and incorrect calculation flaws. In simple terms, the software miscalculates specific request parameters—such as video duration or token counts—in a way that can wrap numbers around their maximum limits, causing the system to process a charge as a credit instead of a debit.

How does an attacker trigger this billing flaw?

An attacker exploits this by sending API requests containing specific, crafted numeric values for parameters like image count or token limits. Simply accessing the API does not trigger the bug; the attacker must intentionally provide these specific, large input values to force the flawed mathematical conversion in the software's quota logic.

Is my New API instance at risk?

According to Halo Surface Signal, this software is designed to act as a public-facing gateway, making it highly likely that your instance is exposed to network traffic. If your deployment is reachable via the internet, you should assume it is a potential target for this type of financial manipulation.

How should I respond to this vulnerability?

Your first step is to locate all instances of New API within your infrastructure and confirm their version numbers. If you are running any version prior to 1.0.0-rc.18, you must prioritize upgrading to the patched release to stop the potential manipulation of billing credits and prevent the unauthorized draining of upstream funds.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.