CVE-2026-7643 — ChatGPTNextWeb NextChat Vulnerability

title: CVE-2026-7643 - NextChat API Endpoint Cross-Domain Policy Manipulation
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-7643 by targeting the NextChat API endpoint, specifically the '/api/auth/session' path, with a POST request that includes a 'callback=' parameter in the query string. This pattern is indicative of an attempt to manipulate cross-domain policies with untrusted domains, as described in the vulnerability details. The 'referer' field check helps to narrow down to requests originating from the NextChat application itself, making the detection more specific to the vulnerable component.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7643/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/auth/session'
      cs-method:
          - 'POST'
      sc-status:
          - '200'
      cs-uri-query|contains:
          - 'callback='
      referer|contains:
          - 'localhost:3000'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse