Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82909QuantumNous new-api Revoked API Token token session expiration

Medium 4.3

In plain English

A medium-severity security flaw in new-api from QuantumNous. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.

Affected products (as reported)

Vendor	Product	Versions
QuantumNous	new-api	1.0.0-rc.01.0.0-rc.11.0.0-rc.21.0.0-rc.31.0.0-rc.41.0.0-rc.51.0.0-rc.61.0.0-rc.7

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

References

VDB-397289 | QuantumNous new-api Revoked API Token token session expiration vdb-entry
VDB-397289 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-82909 | CVE Analysis and Report third-party-advisory
Submit #877769 | QuantumNous new-api v1.0.0-rc.15 Insufficient Session Expiration third-party-advisory
https://github.com/yaowenxiao721/Poc/blob/main/New-API/new-api-poc1.md exploit
https://github.com/QuantumNous/new-api/commit/0d5995eb63f8801d32eb32fbe74b75b68752bfa9 patch
https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.17 patch
https://github.com/QuantumNous/new-api/ product