Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-64866 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controlle… https://www.cve.org/CVERecord?id=CVE-2026-64866
Post summary
The snippet provides a brief notice of CVE‑2026‑64866, noting an API related issue with AdminResetPasskey, but offers no evidence of PoC, exploit, or patch information.
🚨*CVE* CVE-2026-64866 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controlle… https://www.cve.org/CVERecord?id=CVE-2026-64866 ----- Traducción: CVE-2026-64866 New… https://infoflow.cloud`
Post summary
The text briefly announces CVE-2026-64866 with a link to the CVE record but provides no technical or exploit details.