A logic flaw in the universal secure verification flow of the New API allows an authenticated user who has a registered passkey to satisfy secure verification without completing the WebAuthn assertion. This bypasses the mandatory biometrics or hardware-based challenge, enabling the user to perform privileged actions normally protected by step-up verification, potentially exposing root-only channel secrets. The vulnerability is an authentication bypass (CWE-287) and does not confer remote code execution but permits unauthorized privileged operations.

QuantumNous new-api, versions 0.10.0 and newer, including the 0.11.9-alpha1 release, are affected. All deployments that use the passkey as a step-up verification method for privileged secure-verification actions are impacted, irrespective of deployment scale.

The CVSS base score is 4.9, indicating moderate severity. The EPSS score is reported as less than 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting a low exploitation likelihood. The flaw is exploitable only by users who have already authenticated and possess a valid passkey, limiting the scope to compromised or insider accounts. No public exploits or zero-day proof-of-concepts are currently documented. Based on the description, the likely attack vector is a privilege escalation via step-up verification bypass.