EUVD-2026-25300
GHSA-2pp5-c2qh-f9wq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated lookup needing only PNR and surname gives AV:N/AC:L/PR:N/UI:N; pure data disclosure means C:H with I:N/A:N and no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
4DescriptionCVE.org
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. The issue arises from improper access control on a sensitive data retrieval function.
AnalysisAI
Broken access control in SpiceJet's Online Booking System exposes complete passenger records through the public booking-retrieval page, which requires only a PNR code and passenger last name with no authentication or ownership verification. Any unauthenticated internet user who obtains or guesses these two inputs can retrieve extensive personal, travel, and booking metadata. No public exploit has been identified at time of analysis and EPSS is low (0.06%), but CISA's SSVC framework rates the flaw as automatable, meaning enumeration at scale is technically feasible.
Technical ContextAI
The affected component is SpiceJet's web-based passenger booking retrieval endpoint (CPE cpe:2.3:a:spicejet:online_booking_system). The root cause is CWE-306 (Missing Authentication for a Critical Function): a sensitive data-retrieval function is reachable without any session, credential, or ownership check. The PNR (Passenger Name Record) locator combined with a surname is treated as a sufficient secret, but a PNR is a short, low-entropy alphanumeric code printed on tickets, boarding passes, and baggage tags, and surnames are broadly known or guessable. This turns what should be an authenticated 'manage my booking' function into an open data-lookup service, enabling authorization bypass and information disclosure of airline booking metadata.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, and because this is a hosted web application, remediation must occur server-side at SpiceJet rather than via customer-installed updates; consult the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-04 for vendor guidance. The primary fix is to add real authentication and ownership binding to the booking-retrieval function - require an authenticated account session or a one-time verification code sent to the contact email/phone on the reservation before releasing booking details, so that PNR plus surname alone is insufficient. Compensating controls the operator can apply immediately include rate-limiting and CAPTCHA on the retrieval endpoint to blunt automated enumeration (trade-off: minor friction for legitimate customers), enforcing per-IP and per-PNR lockout after repeated failed lookups to defeat brute-forcing (trade-off: possible false lockouts behind shared NAT), minimizing the fields returned to only what a traveler needs rather than full booking metadata (trade-off: reduced self-service convenience), and monitoring/alerting on high-volume lookup patterns. Because the affected party is the airline, downstream organizations cannot patch this themselves and should instead advise travelers to treat PNRs as sensitive and avoid exposing boarding passes or baggage tags.
More in Online Booking System
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today