Junglewise Threat Intelligence

CVE-2026-82909: QuantumNous new-api session expiration in Revoked API Token Handler

CVE-2026-82909 · Severity: medium · CVSS 4.3 · Published 2026-08-31

Executive brief

QuantumNous new-api is an AI model aggregation and gateway service that manages API tokens for enterprises and individuals. A vulnerability in the Revoked API Token Handler allows improper token state validation, potentially causing premature session expiration or unauthorized access to read-only data. This could disrupt legitimate user sessions and expose usage information.

Technical details

The vulnerability exists in the /api/usage/token/ endpoint's Revoked API Token Handler middleware, where authentication logic incorrectly rejects revoked tokens instead of allowing read-only access. The root cause is insufficient state validation in the TokenAuthReadOnly() function in middleware/auth.go—the handler was denying all non-enabled token states rather than only explicitly disabled ones. An attacker can manipulate token status to trigger session expiration or bypass intended token restrictions. This is a remote, unauthenticated or low-privilege attack. The patch (commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9) refines the logic to permit read-only queries for revoked tokens while blocking only disabled tokens. Upgrading to version 1.0.0-rc.17 or later resolves the issue.

Affected products

  • QuantumNous new-api up to 1.0.0-rc.15

Timeline

  • 2026-08-31: disclosed
  • 2026-08-31: patched: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9

References

Related threats