AI-assisted source summary. Explore the background and follow the original sources below.
Scope
New API advisory GHSA-xff3-5c9p-2mr4; self-hosted AI API reseller operations
Time context
Advisory published April 22, 2026; policy checked October 21, 2026
Sources checked
This establishes a disclosed software vulnerability, not that a particular shop was hacked, stole funds or disappeared. The patch listed here addresses this advisory; it is not a claim that an old release is safe today.
Quota was not necessarily money received
The maintainer's April advisory lists versions before v0.12.10 as affected and v0.12.10 as patched. It describes payment-callback validation failures that could grant quota without payment and leave the operator paying upstream model costs.
A setup fee does not settle the maintenance question
The project's security policy supports the latest version and provides a private vulnerability-reporting route. Our operational takeaway is to agree who tracks updates, tests payment reconciliation and handles incidents before selling prepaid balances. This is a checklist inferred from the documented risk, not evidence against a seller.
Original sources used for this summary. Multiple links from one publisher are not independent corroboration. Source material may change after the check date.
AI-assisted research, writing and translation by No Secrets, using the linked public documents. This is a source summary, not firsthand reporting or an independently audited investigation. No affiliate links are used in this article.
The date above records this research pass, not the date of every underlying event. The English and Chinese versions are AI-assisted summaries; the linked original controls if they differ.