Critical Advisory: Integer Overflow in New API Billing Lets Users Self-Credit Balance (Exploited in the Wild)

Update — same-day critical advisory. A GitHub Security Advisory (GHSA-8r8v-xf7q-rcpr, CVE-2026-71479, CVSS 9.1) discloses an integer overflow in the quota billing logic of github.com/QuantumNous/new-api, a Go-based LLM API gateway/billing proxy. The maintainers report the flaw was confirmed exploited in the wild before disclosure.

What happened

According to the advisory, multiple billing code paths multiply user-controlled quantity parameters (such as an image generation count n) into quota calculations without an upper bound or overflow-safe conversion. A crafted extreme value — accepted because the field is a *uint that can carry a wrapped-negative magnitude — causes conversions like int(float64(quota) * n) to wrap past the int64/int32 range into a large negative number. Because that negative quota is applied at settlement (after the request completes) rather than at the pre-consume balance check, it functions as a credit: a small positive balance can be inflated into an enormous one with a single crafted request.

The maintainers note this is not a zero-balance freebie — the attacker's account must already hold a positive balance sufficient to pass the pre-consume check. However, they flag that deployments with self-registration and any free-balance mechanism enabled (check-in rewards, invite rebates, or new-user quota gifts) let an attacker obtain that seed balance for free, effectively making exploitation unauthenticated at scale.

Per the published timeline (UTC+8), a community operator reported large negative consumption entries and abnormally inflated balances on 2026-07-06 23:00; the maintainers confirmed active exploitation and shipped an emergency fix (v1.0.0-rc.18) roughly two hours later, followed by public disclosure the next day and a further release (v1.0.0-rc.19) adding quota-saturation audit logging.

Why it matters for defenders

Any organization self-hosting New API as an LLM billing/proxy gateway is potentially affected. A successful exploit lets a low-privilege authenticated user manufacture unlimited internal balance, which can then be used to drain the operator's real prepaid upstream API funds (OpenAI, Anthropic, etc.) or exhaust service capacity — a billing-integrity failure with direct financial impact, not just a service bug. The advisory's confirmation of in-the-wild exploitation means this should be treated as an active threat, not a theoretical finding.

What defenders should watch for or do now

• Identify any self-hosted New API deployments and upgrade to v1.0.0-rc.19 or later, which adds saturating quota-math conversions and upper-bound validation per the advisory.
• Review consumption/task logs for abnormally large negative quota entries or sudden, unexplained balance inflation on user accounts — the maintainers note rc.19 adds admin-visible admin_info.quota_saturation audit fields for this purpose.
• Audit whether self-registration and free-balance features (check-in rewards, invite rebates, new-user quota gifts) are enabled; consider disabling them or adding rate limits until patched, since they lower the bar for obtaining the seed balance needed to trigger the overflow.
• At a high level, hunt for requests carrying anomalously large or negative-wrapping numeric parameters (e.g., generation counts, durations) in API gateway logs, and monitor for spikes in upstream API spend that don't correlate with legitimate traffic.

This is developing, net-new intel based on the vendor's own advisory; details may be refined as further analysis emerges. See the original GitHub Security Advisory for full technical detail: GHSA-8r8v-xf7q-rcpr.