TI-2026-25338 Aliases CVE-2026-32879 GHSA-5353-f8fq-65vc

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

LOW 22CWE-287Published 2026-03-23 · Updated 2026-03-24

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QuantumNous	new-api	0.10.0 – 0.11.9-alpha.1	—	No fix listed	CNA
—	github.com/QuantumNous/new-api (Go)	0.10.0 – 0.11.9-alpha.1	—	No fix listed	GHSA-5353-f8fq-65vc

new-api VendorQuantumNous Affected 0.10.0 – 0.11.9-alpha.1 Fixed in — No fix listed CNA
github.com/QuantumNous/new-api (Go) Vendor— Affected 0.10.0 – 0.11.9-alpha.1 Fixed in — No fix listed GHSA-5353-f8fq-65vc

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:newapi:new_api::::::::	0.10.0 to before 0.11.9	Vulnerable	QuantumNous
cpe:2.3:a:newapi:new_api:0.11.9:alpha1::::::	0.11.9 alpha1	Vulnerable	QuantumNous

cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* Versions 0.10.0 to before 0.11.9 Vulnerable ·QuantumNous
cpe:2.3:a:newapi:new_api:0.11.9:alpha1:*:*:*:*:*:* Versions 0.11.9 alpha1 Vulnerable ·QuantumNous

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-32879
2026-10-03 Alias added: GHSA-5353-f8fq-65vc

References

Advisory 1

https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc

Other 1

https://github.com/QuantumNous/new-api

TI-2025-35042 QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1HIGH 8.8
TI-2026-30643 New API: SSRF Filter Bypass via 0.0.0.0 CVSS 4.0HIGH 7.1
TI-2026-30031 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVSS 3.1HIGH 8.2
TI-2026-20865 New API has Potential XSS in its MarkdownRenderer component CVSS 3.1HIGH 7.6
TI-2026-20698 New API has an SQL LIKE Wildcard Injection DoS via Token Search CVSS 4.0HIGH 7.1
TI-2026-23715 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences