Log in Start free

Vulnerability · Published May 23, 2026 · Assigned by VulDB

CVE-2026-9306QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

Low 3.7

In plain English

A low-severity authorization bypass via user-controlled key in new-api from QuantumNous. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 78.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
QuantumNous new-api 0.12.00.12.1

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References