CVE-2026-32879 json
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
published 2026-03-23 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-14522 , GHSA-5353-f8fq-65vc , GO-2026-4813
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
Patch / fix
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260326T203309-150000.1.155.2
suse advisories SUSE-SU-2026:1135-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/QuantumNous/new-api | >=0.10.0, <=0.11.9-alpha.1 >=0.10.0 |
no fix listed |
Affected products
- QuantumNous new-api
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc
web, mitigation, vendor-advisory, advisory
-
github.com
/QuantumNous/new-api
package
Sources
- CVE List CVE-2026-32879
- GitHub Advisory GHSA-5353-f8fq-65vc
- NVD CVE-2026-32879
- OSV GO-2026-4813
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.