Auth bypass in Spicejet Online Booking System

CVE-2026-6375

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate val…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.001 (26.3th percentile) — read the EPSS interpretation.