CVSS 3.1
4.9 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVE-2026-32879
Medium (4.9) in newapi new api. EPSS 0.3% chance of exploitation in the next 30 days.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- newapi:new_api
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5353-f8fq-65vc | Go | github.com/QuantumNous/new-api | >=0.10.0 <=0.11.9-alpha.1 | no fix published |
| GO-2026-4813 | Go | github.com/QuantumNous/new-api | >=0.10.0 | no fix published |