THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-64866 — New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a

[NVD] CVE-2026-64866 — New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a

lownvdPublished 2026-08-17

CVE-2026-64866 CVSS: None Published: 2026-08-17T16:17:22.570

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a

MITRE ATT&CK techniques

Artificial IntelligenceT1588.007

Indicators of compromise

CVE-2026-64866cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64866