View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information.

The following versions of SpiceJet Online Booking System are affected:

Online Booking System vers:all/* (CVE-2026-6375, CVE-2026-6376)

CVSS Vendor Equipment Vulnerabilities

v3 7.5 SpiceJet SpiceJet Online Booking System Authorization Bypass Through User-Controlled Key, Missing Authentication for Critical Function

Background

Critical Infrastructure Sectors: Transportation Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: India

Vulnerabilities

Expand All +

CVE-2026-6375

A vulnerability in SpiceJet's booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names.…