This vulnerability exists in the AdminResetPasskey controller of the New API LLM gateway. It allows an administrator with a lower or equal privilege level to delete the passkeys of any user who has the same or a higher privilege level, including root accounts, because the canManageTargetRole authorization check is omitted for the DELETE /api/user/:id/reset_passkey endpoint. Removing a passkey deprives the target account of its authentication token and prevents it from accessing the system, thereby causing a denial of service to that account. The flaw is a missing‑authorization issue (CWE‑862).

The vulnerability affects QuantumNous New API releases from 0.9.1.3 up to (but not including) 1.0.0‑rc.7. The missing authorization check was corrected in release 1.0.0‑rc.7, and all versions newer than that are not affected. Systems running any of the aforementioned vulnerable releases are at risk.

The CVSS score is 5.1, indicating moderate severity. No EPSS score is available, so the current probability of exploitation is not quantified. The vulnerability does not appear in the CISA KEV catalog, suggesting no publicly known exploits. An attacker can exercise the flaw by sending an authenticated DELETE request to /api/user/:id/reset_passkey; because role checks are not performed, any administrator can target accounts at the same or higher privilege level. Prompt remediation is recommended to avoid accidental or malicious account lockout.