This vulnerability in ChatGPTNextWeb NextChat (up to version 2.16.1) arises from a permissive cross-domain policy that includes untrusted domains, potentially enabling remote attackers to bypass same-origin restrictions. The flaw is located in an unknown function of the Next.js file within the API Endpoint component. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity), indicating it requires no privileges, no user interaction, and has a low impact on integrity. Although an exploit is publicly available, the vendor has not issued any remediation or official response to date.

The vulnerability allows remote attackers to exploit a permissive cross-domain policy, potentially enabling unauthorized cross-origin interactions with the affected application. This could lead to limited integrity impacts as indicated by the CVSS vector. Since the vulnerability does not require privileges or user interaction, it could be leveraged remotely without authentication. However, the overall impact is assessed as medium severity. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as restricting cross-origin resource sharing (CORS) policies or using web application firewalls to limit cross-domain requests until an official fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.