# CVE-2026-64866: QuantumNous new-api admin passkey reset privilege escalation

Source: https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64866 · Severity: medium · CVSS 4 · Published 2026-08-17

The new-api software provides account management functionality for a user authentication system. A flaw in the admin passkey reset feature allows lower-privileged administrators to remove authentication factors from accounts with equal or higher privileges, including root accounts. This could enable attackers with admin access to weaken security protections on critical accounts and gain unauthorized access.

Technologies: [github.com/QuantumNous/new-api (Go)](https://junglewise.ai/threats/technologies/github-com-quantumnous-new-api), [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-64866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64866 being exploited in the wild.

**How severe is CVE-2026-64866?** Medium severity, with a CVSS score of 4, published 17 August 2026.

**Which products and versions are affected?** github.com/QuantumNous/new-api (Go) >= 0.9.1.3, < 1.0.0-rc.7, ECOSYSTEM:introduced=0.9.1.3,fixed=1.0.0-rc.7, SEMVER:introduced=0,fixed=1.0.0-rc.7; QuantumNous New API v0.9.1.3 through before v1.0.0-rc.7.

**Is there a fix for CVE-2026-64866?** Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64866 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-64866?** Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later

  ```sh
  go get github.com/QuantumNous/new-api@v1.0.0-rc.7
  ```


## Technical details

This is a missing authorization vulnerability (CWE-862) in the admin passkey reset endpoint of new-api. The AdminResetPasskey function in controller/passkey.go lacked the role-level authorization check present in comparable privileged account-protection endpoints. A lower-privileged administrator can send DELETE requests to /api/user/:id/reset_passkey to remove passkeys from same-level or higher-privileged user accounts. The vulnerability requires the attacker to already possess administrator credentials, limiting the attack surface. The fix, deployed in v1.0.0-rc.7, adds a canManageTargetRole check before passkey lookup or deletion, preventing cross-privilege-level operations. Workarounds include network-level restrictions blocking the vulnerable endpoint except for root operators.

## Affected products

- QuantumNous new-api v0.9.1.3 through before v1.0.0-rc.7

## Identifiers

- CVE-2026-64866
- GHSA-p845-629j-rcj6
- GO-2026-6244

## Timeline

- 2026-07-03: disclosed: Initially published to GitHub Advisory Database
- 2026-08-17: advisory: Published to GitHub Advisory Database
- 2026-08-17: patched: Fix available in v1.0.0-rc.7

## References

- [https://api.github.com/users/Mi0uno](https://api.github.com/users/Mi0uno)
- [https://github.com/Mi0uno](https://github.com/Mi0uno)
- [https://api.github.com/users/Mi0uno/gists%7B/gist_id%7D](https://api.github.com/users/Mi0uno/gists%7B/gist_id%7D)
- [https://api.github.com/users/Mi0uno/repos](https://api.github.com/users/Mi0uno/repos)
- [https://avatars.githubusercontent.com/u/54460383?v=4](https://avatars.githubusercontent.com/u/54460383?v=4)
- [https://api.github.com/users/Mi0uno/events%7B/privacy%7D](https://api.github.com/users/Mi0uno/events%7B/privacy%7D)

## Related threats

- [QuantumNous new-api session expiration in Revoked API Token Handler](https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token)
- [QuantumNous New API integer overflow in quota billing](https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing)
- [QuantumNous new-api unauthenticated payment webhook denial of service](https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of)
- [QuantumNous new-api Redis quota cache race condition in user settings update](https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user)
- [New API user list API information disclosure and privilege escalation](https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege)