CVE-2026-64866: QuantumNous new-api admin passkey reset privilege escalation

CVE-2026-64866 · Severity: medium · CVSS 4 · Published 2026-08-17

The new-api software provides account management functionality for a user authentication system. A flaw in the admin passkey reset feature allows lower-privileged administrators to remove authentication factors from accounts with equal or higher privileges, including root accounts. This could enable attackers with admin access to weaken security protections on critical accounts and gain unauthorized access.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-64866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64866 being exploited in the wild.
How severe is CVE-2026-64866?
Medium severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
github.com/QuantumNous/new-api (Go) >= 0.9.1.3, < 1.0.0-rc.7, ECOSYSTEM:introduced=0.9.1.3,fixed=1.0.0-rc.7, SEMVER:introduced=0,fixed=1.0.0-rc.7; QuantumNous New API v0.9.1.3 through before v1.0.0-rc.7.
Is there a fix for CVE-2026-64866?
Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64866 attacked?
It is attacked over the network.
Am I affected by CVE-2026-64866?
Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later
    go get github.com/QuantumNous/new-api@v1.0.0-rc.7

Technical details

This is a missing authorization vulnerability (CWE-862) in the admin passkey reset endpoint of new-api. The AdminResetPasskey function in controller/passkey.go lacked the role-level authorization check present in comparable privileged account-protection endpoints. A lower-privileged administrator can send DELETE requests to /api/user/:id/reset_passkey to remove passkeys from same-level or higher-privileged user accounts. The vulnerability requires the attacker to already possess administrator credentials, limiting the attack surface. The fix, deployed in v1.0.0-rc.7, adds a canManageTargetRole check before passkey lookup or deletion, preventing cross-privilege-level operations. Workarounds include network-level restrictions blocking the vulnerable endpoint except for root operators.

Affected products

  • QuantumNous new-api v0.9.1.3 through before v1.0.0-rc.7

Identifiers

  • CVE-2026-64866
  • GHSA-p845-629j-rcj6
  • GO-2026-6244

Timeline

  • 2026-07-03: disclosed: Initially published to GitHub Advisory Database
  • 2026-08-17: advisory: Published to GitHub Advisory Database
  • 2026-08-17: patched: Fix available in v1.0.0-rc.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.