Auth bypass in Spicejet Online Booking System

CVE-2026-6376

A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. The issue arises from improper access control on a sensitive data retrieval function.

Vulnerability class: Broken Authentication

Published · last modified .

EPSS exploit prediction

EPSS: 0.006 (44.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-6376: held from 0.005 to 0.006.

EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001

Affected products

Weakness classification (CWE)

References