Logic Flaw in AI Asset Management System by QuantumNous

CVE-2026-32879

What is CVE-2026-32879?

A security issue has been identified in the New API by QuantumNous, specifically affecting version 0.10.0 and later. The vulnerability arises from a logic flaw within the universal secure verification flow, which permits an authenticated user with a registered passkey to bypass the WebAuthn assertion step. This gap allows unauthorized access to secure verification processes, undermining the intended protection measures. Users are advised not to rely solely on passkeys for privileged secure-verification actions. Instead, implementing TOTP or 2FA where operationally feasible is recommended, alongside temporarily restricting access to affected secure-verification-protected endpoints until a patch is released.

References