What’s Vulnerable › Vulnerabilities
CVE-2026-6375: Authorization bypass through User-Controlled key in SpiceJet Online Booking System
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-23 · updated 2026-10-25
- Weakness: CWE-639
Description
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.
Affected products
- SpiceJet Online Booking System: all versions
References
Get alerted when CVE-2026-6375 or the next vulnerability affects your stack