CVE-2026-11465: One-API Business Logic Vulnerability

CVE-2026-11465 Overview

CVE-2026-11465 is a business logic vulnerability [CWE-840] in the songquanpeng/one-api project, affecting versions up to 0.6.11-preview.7. The flaw resides in the Redeem function within model/redemption.go, which handles the Redemption Code Top-Up Endpoint. An authenticated remote attacker can manipulate redemption logic to trigger inconsistent business state. Public exploit details have been released, but exploitation requires high attack complexity. The vendor pull request to remediate the issue remains pending acceptance at the time of disclosure.

Critical Impact

An authenticated attacker can abuse the redemption code top-up flow to manipulate account balances, with limited integrity impact and no direct confidentiality or availability impact.

Affected Products

• songquanpeng one-api versions up to and including 0.6.11-preview.7
• Component: Redemption Code Top-Up Endpoint
• Function: Redeem in model/redemption.go

Discovery Timeline

• 2026-06-07 - CVE-2026-11465 published to NVD
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11465

Vulnerability Analysis

The vulnerability is classified under [CWE-840] Business Logic Errors. The Redeem function in model/redemption.go processes redemption codes for account top-ups within the one-api service. The implementation does not enforce proper state transitions or atomicity guarantees on the redemption workflow. An authenticated attacker with low privileges can manipulate request flow to produce an inconsistent business state. The exploit has been publicly disclosed through GitHub issue tracking and VulDB references. The attack vector is network-based, but exploitation is rated difficult due to timing or workflow conditions that must be met.

Root Cause

The root cause is improper handling of business logic invariants in the redemption code processing path. The Redeem function likely fails to enforce single-use semantics or atomic state changes between validation and consumption of redemption codes. This allows an attacker to manipulate the top-up flow in ways the developer did not anticipate.

Attack Vector

Exploitation requires an authenticated account on the one-api instance and network reachability to the redemption endpoint. The attacker submits crafted requests against the redemption code top-up flow to trigger the logic flaw. High attack complexity reflects the conditions needed for reliable exploitation, including timing or state-dependent interactions. See the GitHub Issue #2397 and GitHub Pull Request #2399 for technical details on the affected code path.

No verified proof-of-concept code is published for inclusion here. Refer to the VulDB CVE-2026-11465 entry and the upstream repository for additional technical context.

Detection Methods for CVE-2026-11465

Indicators of Compromise

• Repeated or rapid successive POST requests to the redemption top-up endpoint from the same authenticated user.
• Unexpected account balance changes that do not correspond to a single successful redemption transaction.
• Application logs showing duplicate processing of the same redemption code identifier within a short time window.

Detection Strategies

• Audit application logs for redemption events and correlate them against issued code records to identify reuse or duplicated consumption.
• Implement server-side monitoring that flags concurrent or near-simultaneous redemption attempts referencing identical codes.
• Review database transaction logs for redemption records that lack a corresponding state change from unused to used.

Monitoring Recommendations

• Enable verbose logging on the Redeem function and capture request identifiers, user identifiers, and code identifiers for each invocation.
• Alert on anomalies in account top-up patterns, including non-linear balance growth or redemption rates exceeding configured thresholds.
• Monitor the songquanpeng/one-api repository for merge of Pull Request #2399.

How to Mitigate CVE-2026-11465

Immediate Actions Required

• Restrict access to the redemption top-up endpoint to trusted users until a fix is released and deployed.
• Apply rate limiting on the redemption endpoint per authenticated user to reduce the window for logic abuse.
• Audit existing redemption records for evidence of prior abuse and reconcile affected account balances.

Patch Information

A fix has been proposed in Pull Request #2399 against the songquanpeng/one-api repository. At the time of publication, the pull request awaits maintainer acceptance. Operators should track the upstream repository and apply the patched release once available.

Workarounds

• Disable the redemption code top-up feature in deployment configuration if it is not required for business operations.
• Place the one-api service behind an authenticated reverse proxy that enforces strict per-user rate limits on the redemption endpoint.
• Implement server-side checks to ensure redemption codes are atomically marked as consumed before any balance adjustment occurs.

# Example: nginx rate limit on redemption endpoint
limit_req_zone $binary_remote_addr zone=redeem:10m rate=5r/m;

location /api/redemption {
    limit_req zone=redeem burst=2 nodelay;
    proxy_pass http://one-api-backend;
}