sub2api vulnerabilities

2 known vulnerabilities in sub2api from Wei-Shaw. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  sub2api: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-73079Aug 11, 2026Wei-Shaw

  Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Code

• 9.1 Critical severity

  sub2api: Improper Encoding or Escaping of Output

  CVE-2026-27812Feb 26, 2026Wei-Shaw

  Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to