CVE-2026-11465

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-11465

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11465.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-11465

Published

2026-06-07T22:45:09.068Z

Modified

2026-07-15T01:48:51.188114578Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error

Details

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.6.11-preview.0"
                },
                {
                    "last_affected": "0.6.11-preview.0"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11465.json",
    "cwe_ids": [
        "CWE-840"
    ]
}

References

Affected packages

Git / github.com/songquanpeng/one-api

Affected ranges

Type

GIT

Repo

https://github.com/songquanpeng/one-api

Events

Introduced

5c81e40612fc5061bb392dba6c059e8dd63d49dc

Last affected

3f421c4f04c9a63b26f5e0be4055989beb16b0b6

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.6.11-preview.1"
        },
        {
            "last_affected": "0.6.11-preview.1"
        },
        {
            "introduced": "0.6.11-preview.2"
        },
        {
            "last_affected": "0.6.11-preview.2"
        },
        {
            "introduced": "0.6.11-preview.3"
        },
        {
            "last_affected": "0.6.11-preview.3"
        },
        {
            "introduced": "0.6.11-preview.4"
        },
        {
            "last_affected": "0.6.11-preview.4"
        },
        {
            "introduced": "0.6.11-preview.5"
        },
        {
            "last_affected": "0.6.11-preview.5"
        },
        {
            "introduced": "0.6.11-preview.6"
        },
        {
            "last_affected": "0.6.11-preview.6"
        },
        {
            "introduced": "0.6.11-preview.7"
        },
        {
            "last_affected": "0.6.11-preview.7"
        }
    ]
}

Affected versions

0.*

0.6.11-preview.1

0.6.11-preview.2

0.6.11-preview.3

0.6.11-preview.4

0.6.11-preview.5

0.6.11-preview.6

0.6.11-preview.7

v0.*

v0.6.11-alpha.18

v0.6.11-alpha.20

v0.6.11-alpha.21

v0.6.11-preview.1

v0.6.11-preview.2

v0.6.11-preview.3

v0.6.11-preview.4

v0.6.11-preview.5

v0.6.11-preview.6

v0.6.11-preview.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11465.json"