The vulnerability resides in the token search endpoint of the new-api, where user‑supplied keyword and token values are concatenated directly into a SQL LIKE clause without escaping wildcard characters. An attacker can supply patterns such as '%' or '_' that trigger extremely expensive database scans, exhausting server resources and resulting in a denial of service. This weakness, mapped to CWE‑943, leads to a loss of availability for authenticated users, and can be leveraged to disrupt service for any user who can access the search feature.

QuantumNous new-api is affected, specifically all releases prior to v0.10.8‑alpha.10. Users running earlier alpha versions (0.10.8‑alpha.1 through 0.10.8‑alpha.9, and any older builds) are vulnerable. The patch included in v0.10.8‑alpha.10 addresses the unchecked wildcard usage.

The CVSS 3.1 score of 7.1 indicates high severity; however, the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability requires prior authentication and access to the /api/token/search endpoint, so it is not exploitable by unauthenticated actors. The vulnerability does not appear in the CISA KEV catalog, further reducing its known exploitation risk. Nevertheless, the potential for resource exhaustion remains significant for environments with high search traffic or limited database resources.