Auth bypass in Newapi New API
CVE-2026-32879
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Newapi New API — versions 0.11.9
- Quantumnous New-Api — versions >= 0.10.0, <= 0.11.9-alpha.1
Weakness classification (CWE)
References
- github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-32879?
- CVE-2026-32879 is a medium-severity vulnerability in Newapi New API, classified under Improper Authentication. CVSS score: 4.9/10. Published 2026-03-23.
- How severe is CVE-2026-32879?
- Medium severity. CVSS v3 base score is 4.9 out of 10.