# CVE-2026-82909: QuantumNous new-api session expiration in Revoked API Token Handler

Source: https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82909 · Severity: medium · CVSS 4.3 · Published 2026-08-31

QuantumNous new-api is an AI model aggregation and gateway service that manages API tokens for enterprises and individuals. A vulnerability in the Revoked API Token Handler allows improper token state validation, potentially causing premature session expiration or unauthorized access to read-only data. This could disrupt legitimate user sessions and expose usage information.

Technologies: [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-82909 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82909 being exploited in the wild.

**How severe is CVE-2026-82909?** Medium severity, with a CVSS score of 4.3, published 31 August 2026.

**Which products and versions are affected?** QuantumNous New API up to 1.0.0-rc.15.

**Is there a fix for CVE-2026-82909?** A patch was published on 2026-08-31: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82909 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82909?** Check whether you run QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the /api/usage/token/ endpoint's Revoked API Token Handler middleware, where authentication logic incorrectly rejects revoked tokens instead of allowing read-only access. The root cause is insufficient state validation in the TokenAuthReadOnly() function in middleware/auth.go—the handler was denying all non-enabled token states rather than only explicitly disabled ones. An attacker can manipulate token status to trigger session expiration or bypass intended token restrictions. This is a remote, unauthenticated or low-privilege attack. The patch (commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9) refines the logic to permit read-only queries for revoked tokens while blocking only disabled tokens. Upgrading to version 1.0.0-rc.17 or later resolves the issue.

## Affected products

- QuantumNous new-api up to 1.0.0-rc.15

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 1.0.0-rc.17 via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9

## References

- [https://github.com/QuantumNous/new-api/](https://github.com/QuantumNous/new-api/)
- [https://github.com/QuantumNous/new-api/commit/0d5995eb63f8801d32eb32fbe74b75b68752bfa9](https://github.com/QuantumNous/new-api/commit/0d5995eb63f8801d32eb32fbe74b75b68752bfa9)

## Related threats

- [QuantumNous New API integer overflow in quota billing](https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing)
- [QuantumNous new-api unauthenticated payment webhook denial of service](https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of)
- [QuantumNous new-api admin passkey reset privilege escalation](https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation)
- [QuantumNous new-api Redis quota cache race condition in user settings update](https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user)
- [New API user list API information disclosure and privilege escalation](https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege)