SpiceJet vulnerabilities
We track 2 vulnerabilities in SpiceJet products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 23, 2026.
2vulnerabilities
0critical
2high
0exploited
8.7average CVSS score
Latest SpiceJet vulnerabilities
- 8.7 High severity
Online Booking System: Missing Authentication for Critical Functionality
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking
- 8.7 High severity
Online Booking System: Authorization Bypass Through User-Controlled Key
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain