CVE-2026-32879
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
How to fix
- newapi new_api0.11.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| newapi new_api | 0.10.0 ≤ v < 0.11.9, 0.11.9 | 0.11.9 |
| github.com/QuantumNous/new-apiGo | 0.10.0 ≤ v ≤ 0.11.9-alpha.1, 0.10.0 ≤ v | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.