This vulnerability affects the Redeem function in the model/redemption.go file of the songquanpeng one-api product up to version 0.6.11-preview.7. It causes business logic errors that can be triggered remotely, but the attack complexity is high and no privileges or user interaction are required. The vulnerability is publicly known and an exploit is available, but no official patch or remediation has been released yet. The issue is tracked as CVE-2026-11465 with a CVSS 4.0 base score of 2.3, indicating low severity.

The vulnerability may allow remote attackers to manipulate business logic in the Redemption Code Top-Up Endpoint, potentially leading to unintended behavior in the redemption process. However, the attack complexity is high and exploitation is difficult. There are no indications of privilege escalation, confidentiality, integrity, or availability impacts beyond the business logic errors. No known exploits in the wild have been reported.

No official fix or patch is currently available as the pull request to address this issue is pending acceptance. Users should monitor the vendor's repository or advisory channels for updates regarding the acceptance and release of the fix. Due to the high complexity of exploitation and low severity, immediate emergency action is not indicated, but cautious monitoring is recommended.