Skip to content
OpenAdvisories
High ICSA-26-113-04 2 CVEs

SpiceJet Online Booking System

Published Apr 23, 2026 · Updated Apr 23, 2026

Vendor: SpiceJet Product: Online Booking System

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information.

Vulnerabilities 2

  • High 8.7
    CVE-2026-6375

    Authorization bypass through User-Controlled key in SpiceJet Online Booking System

    A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtai…

    SpiceJet Online Booking System
  • High 8.7
    CVE-2026-6376

    Missing authentication for critical function in SpiceJet Online Booking System

    A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking…

    SpiceJet Online Booking System

Revision history

  1. #1

    Initial Publication

References