CVE-2026-64859
Received Received - Intake

Access Token Exposure in New API AI Gateway

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-64859
EUVD
EUVD-2026-60240

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
quantumnous new-api 1.0.0-rc.7
quantumnous new-api to 1.0.0-rc.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the new-api software before version 1.0.0-rc.7. The User List API and user lookup endpoints incorrectly expose the root user's access token in responses. This happens because the User.AccessToken field is serialized as 'access_token' even though the password field is omitted. Authenticated admin users can retrieve this token and use it to impersonate the root user, bypassing role restrictions and gaining full system control.

Detection Guidance

Check API responses from the User List API or user lookup endpoints for the presence of an 'access_token' field in the JSON output. Use tools like curl to query GET /api/user/ with admin credentials and inspect the response for exposed tokens.

Impact Analysis

An attacker with admin access could obtain the root user's access token and impersonate the root user. This allows them to bypass role restrictions, access root-only system configuration APIs, and gain full control over the system. The impact includes unauthorized access, data breaches, and potential system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory standards for access control and data protection.

Mitigation Strategies

Upgrade to version 1.0.0-rc.7 or later immediately. Rotate all exposed access tokens, especially the root user's token, before upgrading. Restrict admin access to user management APIs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart