CVE-2026-7643

MEDIUM

ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy

Title source: cna
STIX 2.1

Description

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry vdb-entry
VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
https://vuldb.com/vuln/360755
Signature, Permissions Required signature permissions-required
VDB-360755 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/360755/cti
Third Party Advisory third-party-advisory
Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policy
https://vuldb.com/submit/806833

Scores

CVSS v3 4.3
EPSS 0.0002
EPSS Percentile 3.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-346 CWE-942
Status published
Products (2)
ChatGPTNextWeb/NextChat 2.16.0
ChatGPTNextWeb/NextChat 2.16.1
Published May 02, 2026
Tracked Since May 02, 2026