| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/QuantumNous/new-api | ≥ 0.10.0, ≤ 0.11.9-alpha.1≥ 0.10.0 | |
| new api | = 0.11.9≥ 0.10.0, < 0.11.9 | 0.11.9 |
A logic flaw in the universal secure verification flow allows an authenticated user with a registered passkey to satisfy secure verification without completing a WebAuthn assertion.
= v0.10.0
The POST /api/verify endpoint supports multiple secure verification methods, including passkeys. When the request body contains {"method":"passkey"}, the server only checks whether the authenticated account has a passkey record on file and then marks the secure verification session as complete. It does not verify that the requester successfully completed a WebAuthn assertion.
As a result, an authenticated user who already has a valid session and a registered passkey can satisfy the secure verification requirement without performing the intended passkey challenge/response flow.
In the upstream project, this issue affects actions protected by SecureVerificationRequired(). At the time of publication, the confirmed upstream impact is the root-only POST /api/channel/:id/key endpoint, which returns stored channel secrets.
Successful exploitation requires:
No full login bypass or cross-account privilege escalation has been confirmed in the upstream codebase. However, the issue defeats the intended step-up verification control for affected privileged actions.
Until a patched release is applied:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free