A critical URL validation vulnerability in NextChat allows unauthenticated attackers to steal sensitive OpenAI API keys, posing a severe risk to service integrity and financial costs.

The application performs insufficient input validation on the x-base-url header within the proxy endpoint, utilizing unsafe substring matching rather than proper hostname parsing. This flaw allows an unauthenticated attacker to supply a malicious URL containing the string api.openai.com, which forces the server to include its configured OpenAI API key in the Authorization header of the outbound request.

The exposure of an OpenAI API key can lead to significant financial loss, as unauthorized parties may consume the organization's API quota. Furthermore, this vulnerability facilitates unauthorized access to third party services, potentially resulting in data exfiltration or the manipulation of AI generated content, which could cause reputational damage. With a CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent operational disruption and illicit cost accumulation.

Immediate Action: Identify and isolate instances of NextChat running versions 2.15.8 through 2.16.1, and restrict public access to the proxy endpoint until a security patch is verified and applied.

Proactive Monitoring: Review web server and application access logs for unusual requests to the proxy endpoint, specifically monitoring for the x-base-url header containing suspicious or unexpected destination domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests where the x-base-url header does not strictly match authorized OpenAI endpoints, effectively virtual patching the validation logic.

Public Exploit Available: Unknown

Given the high severity and ease of exploitation associated with API key disclosure, administrators must prioritize the remediation of this vulnerability. If an official patch is not yet available, verify if the service can be configured to disable the proxy functionality or restrict access to trusted internal networks only. Continuous monitoring of API usage and billing alerts is recommended until the underlying validation logic is corrected.