Executive brief
The new-api software provides account management functionality for a user authentication system. A flaw in the admin passkey reset feature allows lower-privileged administrators to remove authentication factors from accounts with equal or higher privileges, including root accounts. This could enable attackers with admin access to weaken security protections on critical accounts and gain unauthorized access.
Technical details
This is a missing authorization vulnerability (CWE-862) in the admin passkey reset endpoint of new-api. The AdminResetPasskey function in controller/passkey.go lacked the role-level authorization check present in comparable privileged account-protection endpoints. A lower-privileged administrator can send DELETE requests to /api/user/:id/reset_passkey to remove passkeys from same-level or higher-privileged user accounts. The vulnerability requires the attacker to already possess administrator credentials, limiting the attack surface. The fix, deployed in v1.0.0-rc.7, adds a canManageTargetRole check before passkey lookup or deletion, preventing cross-privilege-level operations. Workarounds include network-level restrictions blocking the vulnerable endpoint except for root operators.
Affected products
- QuantumNous new-api v0.9.1.3 through before v1.0.0-rc.7
Timeline
- 2026-07-03: disclosed: Initially published to GitHub Advisory Database
- 2026-08-17: advisory: Published to GitHub Advisory Database
- 2026-08-17: patched: Fix available in v1.0.0-rc.7