7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25591

CVE-2026-25591: New API has an SQL LIKE Wildcard Injection DoS via Token Search

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by crafting malicious search patterns. The token search endpoint accepts user-supplied keyword and token parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (%, _). This allows attackers to inject patterns that trigger expensive database queries. Version 0.10.8-alpha.10 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25591

CVE-2026-25591:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/QuantumNous/new-api	go	< 0.10.8-alpha.10	0.10.8-alpha.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL wildcard injection in the token search functionality, leading to a Denial of Service. The root cause is within the SearchUserTokens function in model/token.go, which directly incorporates unsanitized user-supplied keyword and token strings into a SQL LIKE clause. This is explicitly shown in the removed code from the patch: err = DB.Where("user_id = ?", userId).Where("name LIKE ?", "%"+keyword+"%").Where(commonKeyCol+" LIKE ?", "%"+token+"%").Find(&tokens).Error. An attacker can provide a wildcard character like % as the keyword, forcing the database to perform a full table scan, consuming excessive CPU and memory.

The controller/token.go file contains the SearchTokens function, which acts as the HTTP handler for the /api/token/search route. This function reads the keyword and token from the query parameters and passes them directly to the vulnerable model.SearchUserTokens function. The call tokens, err := model.SearchUserTokens(userId, keyword, token) confirms this data flow. Consequently, both controller.SearchTokens and model.SearchUserTokens are critical functions that would appear in a stack trace when the vulnerability is exploited. The patch addresses this by completely rewriting model.SearchUserTokens to add input sanitization, pagination, and by introducing rate limiting at the routing layer.

Vulnerable functions

SearchUserTokens

model/token.go

This function constructs and executes a SQL query using user-provided `keyword` and `token` parameters. It fails to sanitize or escape SQL LIKE wildcard characters (`%`, `_`), allowing an attacker to inject malicious patterns (e.g., `%`). These patterns cause the database to perform expensive, resource-intensive scans, leading to a Denial of Service. The vulnerable implementation was completely replaced by a hardened version in the patch.

SearchTokens

controller/token.go

This function is the HTTP handler for the `/api/token/search` endpoint. It retrieves the `keyword` and `token` from the user's request and passes them directly to the vulnerable `model.SearchUserTokens` function without any validation or sanitization. As the entry point for the malicious input, it would appear in any runtime profile or stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.