CVE-2026-82909: Session Expiration in QuantumNous new-api
Description
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.
CVSS v4.0
Score 5.3medium
Affected software
QuantumNous
new-api
cpe:2.3:a:quantumnous:new-api:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82909 describes a vulnerability in QuantumNous new-api up to version 1.0.0-rc.15 affecting the Revoked API Token Handler functionality at the /api/usage/token/ endpoint. The flaw allows an attacker to remotely manipulate the system to cause session expiration. The vulnerability has been publicly disclosed, and a patch is available in version 1.0.0-rc.17 identified by commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9.
Potential Impact
An attacker can remotely cause session expiration by exploiting the vulnerability in the Revoked API Token Handler. This could disrupt user sessions or application functionality relying on session tokens. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, and no privileges or user interaction required.
Mitigation Recommendations
Upgrade QuantumNous new-api to version 1.0.0-rc.17 or later, which contains the official fix for this vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-31T10:11:54.007Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a95e9b2acd9273b49934f45
Added to database: 08/31/2026, 20:53:06 UTC
Last enriched: 09/07/2026, 13:55:32 UTC
Last updated: 10/15/2026, 18:48:24 UTC
Views: 135
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.