Online Booking System vulnerabilities

2 known vulnerabilities in Online Booking System from SpiceJet. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Online Booking System: Missing Authentication for Critical Functionality

  CVE-2026-6376Apr 23, 2026SpiceJet

  A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking

• 8.7 High severity

  Online Booking System: Authorization Bypass Through User-Controlled Key

  CVE-2026-6375Apr 23, 2026SpiceJet

  A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain