CVE-2026-82909— QuantumNous new-api Revoked API Token token session expiration
Quick assessment
Affected
QuantumNous new-api
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 QuantumNous new-api（版本至 1.0.0-rc.15）中发现了一个安全漏洞。该漏洞影响的是组件“已撤销 API 令牌处理器”中 文件中的某些未知功能。攻击者通过执行特定操作可导致会话过期。此攻击可远程发起。该漏洞的利用方式已公开披露，可能被实际利用。升级到版本 1.0.0-rc.17 可解决此问题。修复该问题的补丁名为 0d5995eb63f8801d32eb32fbe74b75b68752bfa9。建议升级受影响的组件。
Possible ATT&CK Techniques 2 AI
T1039 · Data from Network Shared Drive T1531 · Account Access Removal
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82909
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QuantumNous new-api Revoked API Token token session expiration
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QuantumNous | new-api | 1.0.0-rc.0 |
cpe:2.3:a:quantumnous:new-api:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82909
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82909
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82909 (1)
Proof of Concept for CVE-2026-82909 (1)
News Coverage for CVE-2026-82909 (1)
-
🔗 CVE-2026-82909 in new-api third-party-advisory
Vendor Pages for CVE-2026-82909 (1)
Other References for CVE-2026-82909 (2)
IV. Related Vulnerabilities
Same product: new-api
-
CVE-2026-64865
New API: Redis user quota cache overwrite via PUT /api/user/ -
CVE-2026-71479
New API: Integer overflow in quota billing yields negative c -
CVE-2026-64866
New API: Admin can reset passkeys for same-level or higher-p -
CVE-2026-64868
New API: Unauthenticated payment webhooks allow memory and d -
CVE-2026-64859
New API: User List API Leaks Root User Access Token Leading
Same vendor: QuantumNous
-
CVE-2026-64865
New API: Redis user quota cache overwrite via PUT /api/user/ -
CVE-2026-71479
New API: Integer overflow in quota billing yields negative c -
CVE-2026-64866
New API: Admin can reset passkeys for same-level or higher-p -
CVE-2026-64868
New API: Unauthenticated payment webhooks allow memory and d -
CVE-2026-64859
New API: User List API Leaks Root User Access Token Leading
Same weakness: CWE-613
-
CVE-2026-82469
Rodauth before 2.47.0 Authentication Bypass via jwt_refresh -
CVE-2026-81826
Flowintel Fails to Invalidate Active Sessions After Password -
CVE-2025-62342
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-79664
Ech0 before 4.7.3 Access Token Revocation Bypass
V. Comments for CVE-2026-82909
No comments yet