CVE-2026-6375 — Authorization bypass through User-Controlled key in SpiceJet Online Booking System
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predi…
Published: 2026-04-23 · CVSS: 8.7 · CVSS 4.0
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7