Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information.
The following versions of SpiceJet Online Booking System are affected:
Online Booking System vers:all/* (CVE-2026-6375, CVE-2026-6376)
Vendor
Equipment
SpiceJet
SpiceJet Online Booking System
Authorization Bypass Through User-Controlled Key, Missing Authentication for Critical Function
Critical Infrastructure Sectors: Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: India
A vulnerability in SpiceJet's booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended...