新的 API 存在基于密钥的安全升级验证绕过漏洞，导致仅限 root 渠道密钥泄露

This passkey bypass vulnerability poses a significant risk to applications relying on QuantumNous new-api for secure authentication. An attacker who has successfully authenticated and registered a passkey can exploit this flaw to gain unauthorized access to resources or perform actions on behalf of the authenticated user without further verification. The potential impact includes data breaches, privilege escalation, and compromise of sensitive information. While the CVSS score is medium, the ease of exploitation and potential for widespread impact warrant immediate attention.

Applications and services utilizing QuantumNous new-api for authentication, particularly those relying heavily on passkey-based authentication, are at risk. Organizations with legacy systems or those using older versions of the library without robust security monitoring are especially vulnerable.

• go / server:

ps aux | grep new-api

• go / server:

journalctl -u new-api | grep -i "secure verification"

• generic web:

curl -I https://your-new-api-endpoint/api/verify -d '{"method":"passkey"}'

• generic web: Inspect access logs for requests to /api/verify with {"method":"passkey"} and successful responses without WebAuthn challenges.

1. 2026-03-23Disclosure

   disclosure

1. 已保留2026-03-16
2. 发布日期2026-03-23
3. 修改日期2026-03-30
4. EPSS 更新日期2026-03-31

The primary mitigation for CVE-2026-32879 is to upgrade to a patched version of QuantumNous new-api. Consult the QuantumNous project's release notes for the specific version containing the fix. If upgrading is not immediately feasible, consider implementing stricter access controls and monitoring for suspicious activity related to secure verification flows. While a direct WAF rule is unlikely, monitoring for unusual patterns of successful verification without WebAuthn challenges could provide an early warning. Review and strengthen passkey registration and management practices.