CVE-2026-11465

LowCVSS 3.1/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-840

Affected software

No affected versions have been published.

Timeline

Published
Jun 7, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processedCVE-2026-1146526.5A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supCVE-2026-1146536.5A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position thaCVE-2026-1146546.5A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied thCVE-2026-1146555.9libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS proCVE-2026-1146567.5Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certifiCVE-2026-1146575.7Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credeCVE-2026-1146588.8Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors CVE-2026-1146596.5Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes checCVE-2026-114665.4A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepseCVE-2026-1146606.3Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors