Privilege Escalation in New API via Passkey Reset

Executive Summary

This vulnerability is an authorization flaw in the admin passkey reset feature of the New API project. A lower-privileged administrator could remove passkeys from accounts with equal or higher privileges, including root accounts, due to missing role-based authorization checks in the DELETE /api/user/:id/reset_passkey endpoint. The issue existed between versions 0.9.1.3 and 1.0.0-rc.7.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your new_api instance is running a version between 0.9.1.3 and 1.0.0-rc.7. Inspect the passkey.go file for the AdminResetPasskey function to verify if it lacks the canManageTargetRole authorization check. Look for unauthorized passkey resets in logs targeting root or higher-privileged accounts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with lower admin privileges could remove passkeys from higher-privileged accounts, effectively bypassing authentication for those accounts. This could lead to unauthorized access, privilege escalation, or complete system compromise if root accounts are affected. The impact depends on the privileges of the targeted accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and access controls, such as GDPR's security principle (Article 32) or HIPAA's access control safeguards (45 CFR § 164.312(a)(1)). Unauthorized passkey removal undermines authentication integrity and may lead to unauthorized data access or modification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to version 1.0.0-rc.7 or later immediately. If upgrading is not possible, restrict admin access to trusted users only and block the /api/user/:id/reset_passkey endpoint at the reverse proxy level to prevent unauthorized passkey resets.

Useful 0 Not Useful 0