Vulnerability-Lookup

CVE-2026-32879 (GCVE-0-2026-32879)

Vulnerability from cvelistv5 – Published: 2026-03-23 19:24 – Updated: 2026-03-24 15:13

Title

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.

Severity ?

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M

References

URL

Tags

https://github.com/QuantumNous/new-api/security/a…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	QuantumNous	new-api	Affected: >= 0.10.0, <= 0.11.9-alpha.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T14:43:16.316975Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T15:13:22.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "new-api",
          "vendor": "QuantumNous",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.10.0, \u003c= 0.11.9-alpha.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T19:24:16.336Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc"
        }
      ],
      "source": {
        "advisory": "GHSA-5353-f8fq-65vc",
        "discovery": "UNKNOWN"
      },
      "title": "New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32879",
    "datePublished": "2026-03-23T19:24:16.336Z",
    "dateReserved": "2026-03-16T21:03:44.420Z",
    "dateUpdated": "2026-03-24T15:13:22.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32879",
      "date": "2026-04-16",
      "epss": "0.00038",
      "percentile": "0.11301"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32879\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-23T20:16:27.373\",\"lastModified\":\"2026-03-25T17:52:28.520\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.\"},{\"lang\":\"es\",\"value\":\"Nueva API es una pasarela de modo de lenguaje grande (LLM) y un sistema de gesti\u00f3n de activos de inteligencia artificial (IA). A partir de la versi\u00f3n 0.10.0, una falla l\u00f3gica en el flujo de verificaci\u00f3n segura universal permite a un usuario autenticado con una clave de acceso (passkey) registrada satisfacer la verificaci\u00f3n segura sin completar una aserci\u00f3n WebAuthn. A la fecha de publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles. Hasta que se aplique una versi\u00f3n parcheada, no conf\u00ede en la clave de acceso (passkey) como m\u00e9todo de elevaci\u00f3n para acciones privilegiadas de verificaci\u00f3n segura; requiera TOTP/2FA para esas acciones donde sea operacionalmente posible; o restrinja temporalmente el acceso a los puntos finales afectados protegidos por verificaci\u00f3n segura.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.10.0\",\"versionEndExcluding\":\"0.11.9\",\"matchCriteriaId\":\"EF65AC0F-AAD5-448C-9518-09F014D43036\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:newapi:new_api:0.11.9:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"33AF3DD3-4364-45D6-A2EB-775B5AAB406B\"}]}]}],\"references\":[{\"url\":\"https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32879\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-24T14:43:16.316975Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-24T14:43:22.766Z\"}}], \"cna\": {\"title\": \"New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure\", \"source\": {\"advisory\": \"GHSA-5353-f8fq-65vc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"QuantumNous\", \"product\": \"new-api\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.10.0, \u003c= 0.11.9-alpha.1\"}]}], \"references\": [{\"url\": \"https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc\", \"name\": \"https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-23T19:24:16.336Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32879\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-24T15:13:22.246Z\", \"dateReserved\": \"2026-03-16T21:03:44.420Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-23T19:24:16.336Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-32879

Vulnerability from fkie_nvd - Published: 2026-03-23 20:16 - Updated: 2026-03-25 17:52

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	newapi	new_api	*
	newapi	new_api	0.11.9

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF65AC0F-AAD5-448C-9518-09F014D43036",
              "versionEndExcluding": "0.11.9",
              "versionStartIncluding": "0.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:newapi:new_api:0.11.9:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "33AF3DD3-4364-45D6-A2EB-775B5AAB406B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints."
    },
    {
      "lang": "es",
      "value": "Nueva API es una pasarela de modo de lenguaje grande (LLM) y un sistema de gesti\u00f3n de activos de inteligencia artificial (IA). A partir de la versi\u00f3n 0.10.0, una falla l\u00f3gica en el flujo de verificaci\u00f3n segura universal permite a un usuario autenticado con una clave de acceso (passkey) registrada satisfacer la verificaci\u00f3n segura sin completar una aserci\u00f3n WebAuthn. A la fecha de publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles. Hasta que se aplique una versi\u00f3n parcheada, no conf\u00ede en la clave de acceso (passkey) como m\u00e9todo de elevaci\u00f3n para acciones privilegiadas de verificaci\u00f3n segura; requiera TOTP/2FA para esas acciones donde sea operacionalmente posible; o restrinja temporalmente el acceso a los puntos finales afectados protegidos por verificaci\u00f3n segura."
    }
  ],
  "id": "CVE-2026-32879",
  "lastModified": "2026-03-25T17:52:28.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-23T20:16:27.373",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-5353-F8FQ-65VC

Vulnerability from github – Published: 2026-03-23 19:56 – Updated: 2026-03-30 14:06

Summary

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

Details

Summary

A logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion.

Affected versions

= v0.10.0

Description

The POST /api/verify endpoint supports multiple secure verification methods, including passkeys. When the request body contains {"method":"passkey"}, the server only checks whether the authenticated account has a passkey record on file and then marks the secure verification session as complete. It does not verify that the requester successfully completed a WebAuthn assertion.

As a result, an authenticated user who already has a valid session and a registered passkey can satisfy the secure verification requirement without performing the intended passkey challenge/response flow.

Impact

In the upstream project, this issue affects actions protected by SecureVerificationRequired(). At the time of publication, the confirmed upstream impact is the root-only POST /api/channel/:id/key endpoint, which returns stored channel secrets.

Successful exploitation requires: - an already authenticated session for the target account, and - a registered passkey on that account.

No full login bypass or cross-account privilege escalation has been confirmed in the upstream codebase. However, the issue defeats the intended step-up verification control for affected privileged actions.

Workarounds

Until a patched release is applied: - do not rely on passkey as the step-up method for privileged secure-verification actions; - require TOTP/2FA for those actions where operationally possible; or - temporarily restrict access to affected secure-verification-protected endpoints.

Severity ?

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/QuantumNous/new-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "last_affected": "0.11.9-alpha.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-23T19:56:00Z",
    "nvd_published_at": "2026-03-23T20:16:27Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion.\n\n## Affected versions\n\n\u003e= v0.10.0\n\n## Description\n\nThe `POST /api/verify` endpoint supports multiple secure verification methods, including passkeys. When the request body contains `{\"method\":\"passkey\"}`, the server only checks whether the authenticated account has a passkey record on file and then marks the secure verification session as complete. It does not verify that the requester successfully completed a WebAuthn assertion.\n\nAs a result, an authenticated user who already has a valid session and a registered passkey can satisfy the secure verification requirement without performing the intended passkey challenge/response flow.\n\n## Impact\n\nIn the upstream project, this issue affects actions protected by `SecureVerificationRequired()`. At the time of publication, the confirmed upstream impact is the root-only `POST /api/channel/:id/key` endpoint, which returns stored channel secrets.\n\nSuccessful exploitation requires:\n- an already authenticated session for the target account, and\n- a registered passkey on that account.\n\nNo full login bypass or cross-account privilege escalation has been confirmed in the upstream codebase. However, the issue defeats the intended step-up verification control for affected privileged actions.\n\n## Workarounds\n\nUntil a patched release is applied:\n- do not rely on passkey as the step-up method for privileged secure-verification actions;\n- require TOTP/2FA for those actions where operationally possible; or\n- temporarily restrict access to affected secure-verification-protected endpoints.",
  "id": "GHSA-5353-f8fq-65vc",
  "modified": "2026-03-30T14:06:18Z",
  "published": "2026-03-23T19:56:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QuantumNous/new-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-32879 (GCVE-0-2026-32879)

FKIE_CVE-2026-32879

GHSA-5353-F8FQ-65VC

Summary

Affected versions

Description

Impact

Workarounds

Tags

Sightings

Nomenclature