Authorization Bypass in New API’s Passkey Management
CVE-2026-64866

5.1MEDIUM

Key Information:

Vendor

Quantumnous

Status
New-api
Vendor
CVE Published:
17 August 2026

What is CVE-2026-64866?

An authorization check vulnerability in New API allows a lower-privileged administrator to delete a passkey from user accounts with equal or greater privileges, including root accounts. This issue arises in the AdminResetPasskey function within the controller/passkey.go file, exposing the system to potential unauthorized access and privilege escalation. The vulnerability has been resolved in version 1.0.0-rc.7, where proper role checks now inhibit such unauthorized actions.

Affected Version(s)

new-api >= 0.9.1.3, < 1.0.0-rc.7

References

https://github.com/QuantumNous/new-api/security/advisorie...
x_refsource_CONFIRM
https://github.com/QuantumNous/new-api/pull/4929
x_refsource_MISC
https://github.com/QuantumNous/new-api/commit/0936e250465...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.