Executive brief
QuantumNous new-api is an AI model aggregation and gateway service that manages API tokens for enterprises and individuals. A vulnerability in the Revoked API Token Handler allows improper token state validation, potentially causing premature session expiration or unauthorized access to read-only data. This could disrupt legitimate user sessions and expose usage information.
Technical details
The vulnerability exists in the /api/usage/token/ endpoint's Revoked API Token Handler middleware, where authentication logic incorrectly rejects revoked tokens instead of allowing read-only access. The root cause is insufficient state validation in the TokenAuthReadOnly() function in middleware/auth.go—the handler was denying all non-enabled token states rather than only explicitly disabled ones. An attacker can manipulate token status to trigger session expiration or bypass intended token restrictions. This is a remote, unauthenticated or low-privilege attack. The patch (commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9) refines the logic to permit read-only queries for revoked tokens while blocking only disabled tokens. Upgrading to version 1.0.0-rc.17 or later resolves the issue.
Affected products
- QuantumNous new-api up to 1.0.0-rc.15
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9