PT-2026-47196

CVE-2026-11465

Published

2026-06-07

Updated

2026-09-04

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions songquanpeng one-api versions prior to 0.6.11-preview.7

Description A business logic error exists in the Redemption Code Top-Up Endpoint. The issue is located within the Redeem() function of the model/redemption.go file. This flaw allows for remote attacks, although it requires a high level of complexity and is difficult to exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-840

Related identifiers

CVE-2026-11465