Quick answers
- Is CVE-2026-82909 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82909 being exploited in the wild.
- How severe is CVE-2026-82909?
- Medium severity, with a CVSS score of 4.3, published 31 August 2026.
- Which products and versions are affected?
- QuantumNous New API up to 1.0.0-rc.15.
- Is there a fix for CVE-2026-82909?
- A patch was published on 2026-08-31: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82909 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82909?
- Check whether you run QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the /api/usage/token/ endpoint's Revoked API Token Handler middleware, where authentication logic incorrectly rejects revoked tokens instead of allowing read-only access. The root cause is insufficient state validation in the TokenAuthReadOnly() function in middleware/auth.go—the handler was denying all non-enabled token states rather than only explicitly disabled ones. An attacker can manipulate token status to trigger session expiration or bypass intended token restrictions. This is a remote, unauthenticated or low-privilege attack. The patch (commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9) refines the logic to permit read-only queries for revoked tokens while blocking only disabled tokens. Upgrading to version 1.0.0-rc.17 or later resolves the issue.
Affected products
- QuantumNous new-api up to 1.0.0-rc.15
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9