CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users
An administrator can reset passkeys for same-level or higher-privileged users, potentially leading to account takeover or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64866?
CVE-2026-64866 is a medium-severity missing authorization vulnerability in QuantumNous new-api, published on 17 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.
Weakness: CWE-862
Which versions are affected by CVE-2026-64866?
3 open source packages ship an affected version, including github.com/QuantumNous/new-api.
| Package | Affected | Fixed in |
|---|---|---|
github.com/QuantumNous/new-api Go | All versions | 1.0.0-rc.7 |
github.com/QuantumNous/new-api Go | From 0.9.1.3 | 1.0.0-rc.7 |
github.com/QuantumNous/new-api Go | From 0.9.1.3 | 1.0.0-rc.7 |
How do I fix CVE-2026-64866?
Upgrade github.com/QuantumNous/new-api to 1.0.0-rc.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-64866 being exploited?
There is no known exploitation of CVE-2026-64866 in the wild and no public exploit code.
Sources
Also known as GHSA-p845-629j-rcj6, GO-2026-6244.