TI-2026-57199 Aliases CVE-2026-82909 GHSA-76j5-99cp-jhpp

QuantumNous new-api Revoked API Token token session expiration

MEDIUM 57CWE-613Published 2026-08-31 · Updated 2026-09-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed new-api (QuantumNous): 1.0.0-rc.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QuantumNous	new-api	1.0.0-rc.0; 1.0.0-rc.1; 1.0.0-rc.2; 1.0.0-rc.3; 1.0.0-rc.4; 1.0.0-rc.5; 1.0.0-rc.6; 1.0.0-rc.7; 1.0.0-rc.8; 1.0.0-rc.9; 1.0.0-rc.10; 1.0.0-rc.11; 1.0.0-rc.12; 1.0.0-rc.13; 1.0.0-rc.14; 1.0.0-rc.15	1.0.0-rc.17	Patch available	CNA

new-api VendorQuantumNous Affected 1.0.0-rc.0; 1.0.0-rc.1; 1.0.0-rc.2; 1.0.0-rc.3; 1.0.0-rc.4; 1.0.0-rc.5; 1.0.0-rc.6; 1.0.0-rc.7; 1.0.0-rc.8; 1.0.0-rc.9; 1.0.0-rc.10; 1.0.0-rc.11; 1.0.0-rc.12; 1.0.0-rc.13; 1.0.0-rc.14; 1.0.0-rc.15 Fixed in 1.0.0-rc.17 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:quantumnous:new-api::::::::	—	—	—

cpe:2.3:a:quantumnous:new-api:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA new-api (QuantumNous) Fixed in 1.0.0-rc.17

Timeline

2026-10-02 Threatist record created from CVE-2026-82909
2026-10-03 Alias added: GHSA-76j5-99cp-jhpp

References

Exploit 1

https://github.com/yaowenxiao721/Poc/blob/main/New-API/new-api-poc1.md

Patch 2

Other 1

https://github.com/QuantumNous/new-api/

TI-2025-35042 QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1HIGH 8.8
TI-2026-30643 New API: SSRF Filter Bypass via 0.0.0.0 CVSS 4.0HIGH 7.1
TI-2026-30031 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVSS 3.1HIGH 8.2
TI-2026-20865 New API has Potential XSS in its MarkdownRenderer component CVSS 3.1HIGH 7.6
TI-2026-20698 New API has an SQL LIKE Wildcard Injection DoS via Token Search CVSS 4.0HIGH 7.1
TI-2026-23715 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVSS 3.1MEDIUM 6.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences