CVE-2026-11465 | songquanpeng one-api up to 0.6.11-preview.7 Redemption Code Top-Up Endpoint model/redemption.go Redeem logic error (Issue 2397)

A vulnerability, which was classified as critical, was found in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors.

This vulnerability is cataloged as CVE-2026-11465. The attack may be launched remotely. Furthermore, there is an exploit available.

The pull request to fix this issue awaits acceptance.