CVE-2026-32879 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
Authenticated users can bypass passkey verification to disclose root-only channel secrets in the New API LLM gateway.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32879?
CVE-2026-32879 is a medium-severity authentication bypass vulnerability in QuantumNous new-api, published on 23 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
Weakness: CWE-287
Which versions are affected by CVE-2026-32879?
3 open source packages ship an affected version, including github.com/QuantumNous/new-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/QuantumNous/new-api Go | From 0.10.0 | None |
github.com/QuantumNous/new-api Go | From 0.10.0 to 0.11.9-alpha.1 | None |
github.com/QuantumNous/new-api Go | From 0.10.0 to 0.11.9-alpha.1 | None |
Products include Newapi New Api.
How do I fix CVE-2026-32879?
Apply a workaround.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-32879 being exploited?
There is no known exploitation of CVE-2026-32879 in the wild and no public exploit code.
Other vulnerabilities in QuantumNous new-api
- CVE-2025-55573 Cross-site scripting in n/a
- CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
- CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component
- CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
- CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0
Sources
Also known as GHSA-5353-f8fq-65vc, GO-2026-4813.