« Volver al listado

CVE-2026-82909

Estado: AplazadaBaja (2.1)—

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Quantumnous — New-apiAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-82909",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82909",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-02T14:12:10.778540Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:quantumnous:new-api:*:*:*:*:*:*:*:*"
          ],
          "vendor": "QuantumNous",
          "modules": [
            "Revoked API Token Handler"
          ],
          "product": "new-api",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-rc.0"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.1"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.2"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.3"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.4"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.5"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.6"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.7"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.8"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.9"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.10"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.11"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.12"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.13"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.14"
            },
            {
              "status": "affected",
              "version": "1.0.0-rc.15"
            },
            {
              "status": "unaffected",
              "version": "1.0.0-rc.17"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-31T21:17:54.677",
  "references": [
    {
      "url": "https://github.com/QuantumNous/new-api/",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/QuantumNous/new-api/commit/0d5995eb63f8801d32eb32fbe74b75b68752bfa9",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.17",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/yaowenxiao721/Poc/blob/main/New-API/new-api-poc1.md",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-82909",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/877769",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/397289",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/397289/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded."
    }
  ],
  "lastModified": "2026-09-02T15:17:44.690",
  "sourceIdentifier": "cna@vuldb.com"
}