New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-32879
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:05 UTC · Revision 1
Source evidence
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
core-osv · Original sourcePublished 23 Mar 2026, 19:24 UTC
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.
osv:CVE-2026-32879
Complete source record
{
"id": "f3d8d8d1b5afa5719d303f068ea3a73b2b64769953ef1f79f7993f8f90cbc66f",
"url": "https://osv.dev/vulnerability/CVE-2026-32879",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure",
"summary": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion. As of time of publication, no known patched versions are available. Until a patched release is applied, do not rely on passkey as the step-up method for privileged secure-verification actions; require TOTP/2FA for those actions where operationally possible; or temporarily restrict access to affected secure-verification-protected endpoints.",
"evidence": "osv:CVE-2026-32879",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-32879",
"aliases": [
"CVE-2026-32879",
"GHSA-5353-f8fq-65vc",
"GO-2026-4813"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/quantumnous/new-api",
"type": "GIT",
"events": [
{
"introduced": "ee53a7b6bf875778595b0437a5208d65e7e0905c"
},
{
"fixed": "5238f279db8b096d2b50854633cc2b59d1ba4225"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.10.0"
},
{
"last_affected": "0.11.9-alpha.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.10.0"
},
{
"fixed": "0.11.9"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v0.11.9-alpha.2",
"v0.11.9-alpha.3",
"v0.11.9-alpha.1",
"v0.11.8",
"v0.11.7",
"v0.11.6-patch.1",
"v0.11.6",
"v0.11.5",
"v0.11.4-patch.1",
"v0.11.4",
"v0.11.4-alpha.5",
"v0.11.4-alpha.4",
"v0.11.4-alpha.3",
"v0.11.4-alpha.2",
"v0.11.4-alpha.1",
"v0.11.2-patch.2",
"v0.11.2-patch.1",
"v0.11.2-alpha.3",
"v0.11.2",
"v0.11.2-alpha.2",
"v0.11.2-alpha.1",
"v0.11.1-alpha.7",
"v0.11.1-alpha.6",
"v0.11.1-alpha.4",
"v0.11.1-alpha.3",
"v0.11.1-alpha.2",
"v0.11.1-alpha.1",
"v0.11.0",
"v0.11.0-alpha.9",
"v0.11.0-alpha.8",
"v0.11.0-alpha.7",
"v0.11.0-alpha.6",
"v0.11.0-alpha.5",
"v0.11.0-alpha.4",
"v0.11.0-alpha.3",
"v0.11.0-alpha.2",
"v0.11.0-alpha.1",
"v0.10.9-alpha.8",
"v0.10.9",
"v0.10.9-alpha.7",
"v0.10.9-alpha.6",
"v0.10.9-alpha.5",
"v0.10.9-alpha.4",
"v0.10.9-alpha.3",
"v0.10.9-alpha.2",
"v0.10.9-alpha.1",
"v0.10.8",
"v0.10.8-alpha.12",
"v0.10.8-alpha.10",
"v0.10.8-alpha.11",
"v0.10.8-alpha.9",
"v0.10.8-alpha.8",
"v0.10.8-alpha.7",
"v0.10.8-alpha.6",
"v0.10.8-alpha.5",
"v0.10.8-alpha.4",
"v0.10.8-alpha.3",
"v0.10.8-alpha.2",
"v0.10.8-alpha.1",
"v0.10.7-alpha.2",
"v0.10.7-alpha.1",
"v0.10.6-alpha.4",
"v0.10.6-alpha.3",
"v0.10.6-alpha.2",
"v0.10.6-alpha.1",
"v0.10.5",
"v0.10.5-ionet.2",
"v0.10.5-checkin.1",
"v0.10.5-bailian.2",
"v0.10.5-bailian.1",
"v0.10.5-ionet.1",
"v0.10.4",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.1-alpha.8",
"v0.10.1-alpha.6",
"v0.10.1-alpha.5",
"v0.10.1-alpha.4",
"v0.10.1-alpha.3",
"v0.10.1-alpha.2",
"v0.10.1-alpha.1",
"v0.10.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32879.json"
}
}
],
"modified": "2026-10-28T02:30:23.141920143Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32879.json",
"https://github.com/QuantumNous/new-api/security/advisories/GHSA-5353-f8fq-65vc",
"https://nvd.nist.gov/vuln/detail/CVE-2026-32879"
],
"provider_metadata": {
"cwe_ids": [
"CWE-287"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32879.json"
}
},
"related_cves": [
{
"value": "CVE-2026-32879",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489599,
"published_at": "2026-03-23T19:24:16.336+00:00"
}