CVE-2026-11465 json
songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error
published 5mo ago modified 2mo ago also GHSA-7v3v-cp44-vc8m , GO-2026-6126 , EUVD-2026-34996
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Patch / fix
- govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
suse advisories SUSE-SU-2026:23625-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
opensuse advisories openSUSE-SU-2026:21761-1
- github.com/songquanpeng/one-api#2399 pull request
Is CVE-2026-11465 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/songquanpeng/one-api/issues/2397 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| CNA | 3.0 | 3.1 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| CNA | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 1.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/songquanpeng/one-api | >=0.1.6-alpha, <=0.6.11-preview.7 all versions |
no fix listed |
Affected products
- songquanpeng one-api
Classification
References
-
github.com
/songquanpeng/one-api/pull/2399
issue-tracking, patch, web
-
github.com
/songquanpeng/one-api/issues/2397
exploit, issue-tracking, web
-
vuldb.com
/vuln/369085
vdb-entry, technical-description, web
-
vuldb.com
/vuln/369085/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-11465
third-party-advisory, web
-
vuldb.com
/submit/833320
third-party-advisory, web
-
github.com
/songquanpeng/one-api/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-11465
advisory
-
github.com
/songquanpeng/one-api
package
-
github.com
/advisories/GHSA-7v3v-cp44-vc8m
advisory
Sources
- CVE List CVE-2026-11465
- GitHub Advisory GHSA-7v3v-cp44-vc8m
- NVD CVE-2026-11465
- OSV GO-2026-6126
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.