Description

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T21:17:54.677Z",
  "pubdate": "2026-08-31T21:17:54.677Z",
  "executiveSummary": "A vulnerability has been identified in QuantumNous new-api, specifically within the Revoked API Token Handler component.\nThe flaw allows a remote attacker to manipulate requests directed at the /api/usage/token/ endpoint, resulting in unauthorized session expiration.\nThis vulnerability poses a significant risk to service availability and session persistence, as malicious actors can terminate active sessions remotely without legitimate authorization.\nThe vulnerability affects versions up to 1.0.0-rc.15. The issue has been publicly disclosed, increasing the risk of active exploitation by threat actors.\nUsers and administrators are advised to upgrade to version 1.0.0-rc.17 to remediate the flaw, as the vulnerability is confirmed to be patched in that release via commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9.",
  "technicalDetails": "The vulnerability resides within the Revoked API Token Handler of the QuantumNous new-api component, specifically impacting the logic governing the /api/usage/token/ URI.\nThe root cause of this issue stems from insufficient input validation or improper state handling when processing requests at the token revocation endpoint. By sending a maliciously crafted payload to /api/usage/token/, an attacker can influence the internal state of the session management system.\nThe attack vector is entirely remote, requiring no local access to the server infrastructure. The exploit logic leverages the application's API handlers to trigger a forced invalidation of tokens that should otherwise remain active.\nStep-by-step, the attack flow begins with the attacker identifying the target endpoint /api/usage/token/. The attacker then submits a specially crafted request—often manipulating parameters that the application incorrectly trusts—to trick the server into interpreting a legitimate, active session as revoked or expired. Because the handler lacks robust validation of the request context or the authorization state associated with the token modification, the backend server processes the command and updates the session status in the underlying data store to 'expired' or 'revoked'.\nOnce the exploitation is successful, the targeted session is terminated immediately. This results in an effective Denial of Service (DoS) for the affected user, who is forced to re-authenticate. The impact is primarily a disruption of service and potential loss of user state. In environments where high availability or session persistence is critical, this vulnerability could be weaponized to repeatedly drop user sessions, significantly impacting platform utility.\nThis vulnerability affects all iterations of QuantumNous new-api up to 1.0.0-rc.15. The technical remediation provided in commit 0d5995eb63f8801d32eb32fbe74b75b68752bfa9 introduces stricter validation checks within the API token handler to ensure that only authorized calls or legitimate lifecycle events can trigger a session revocation. Authentication and privilege checks appear to have been bypassed or inadequately enforced in the vulnerable versions, allowing remote unauthenticated or low-privilege actors to reach the sensitive token revocation logic."
}