EUVD-2026-68773
GHSA-76j5-99cp-jhpp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires a revoked but valid token credential (PR:L); only usage log confidentiality is affected (C:L), with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.
AnalysisAI
Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a previously issued new-api API token that has been explicitly set to the disabled/revoked status in the system - a revoked-but-known credential. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 accurately characterizes the limited blast radius of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to new-api v1.0.0-rc.17 or later, which incorporates the fix from commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9 (https://github.com/QuantumNous/new-api/commit/0d5995eb63f8801d32eb32fbe74b75b68752bfa9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
New API LLM gateway versions before 0.10.8-alpha.9 are vulnerable to stored cross-site scripting through the MarkdownRen
Denial of service in New API's `/api/token/search` endpoint allows authenticated users to exhaust database resources thr
Authorization bypass in QuantumNous new-api versions up to 0.12.1 allows remote attackers to access Midjourney image rel
An Insecure Direct Object Reference (IDOR) vulnerability exists in New API versions prior to 0.11.4-alpha.2, a large lan
SQL injection in QuantumNous new-api versions up to 0.12.1 allows authenticated remote attackers to manipulate database
A logic flaw in New API's universal secure verification flow allows authenticated users with registered passkeys to bypa
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). Rated high severity (CVSS 8.8), this vulnerab
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today