Suse EUVD-2026-14522

A permanent patch is not yet available for New API. Until a patched release is published, implement the following compensating controls: (1) do not rely on passkey as the sole step-up authentication method for privileged secure-verification actions; (2) require TOTP or hardware-based 2FA (such as time-based one-time passwords or hardware security keys with independent attestation) for all sensitive operations where operationally feasible; (3) temporarily restrict network access to affected secure-verification-protected endpoints to trusted administrative ranges or use reverse proxy authentication in front of the gateway; (4) monitor authentication logs for passkey-based verification attempts and cross-correlate with sensitive action logs to detect exploitation attempts. Subscribe to the GitHub Security Advisory (https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc) for patch availability notifications.