EUVD-2026-34996
GHSA-7v3v-cp44-vc8m
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
AnalysisAI
Race condition in songquanpeng one-api's redemption code feature allows authenticated users to redeem a single-use code multiple times by sending concurrent requests before the transaction completes. The root cause is confirmed by PR diff: the codebase uses deprecated GORM v1 syntax (tx.Set("gorm:query_option", "FOR UPDATE")) that does not reliably apply a database row lock in GORM v2, leaving the transaction window unprotected. All versions up to 0.6.11-preview.7 are affected; a fix exists as an unmerged pull request, and publicly available exploit code is referenced in GitHub issue #2397 - no public exploit has been identified at time of analysis.
Technical ContextAI
one-api is a Go application using the GORM ORM for database access. The Redeem function in model/redemption.go wraps redemption code lookups in a database transaction intended to prevent concurrent double-redemptions via pessimistic locking. The flaw is that the deprecated GORM v1 method tx.Set("gorm:query_option", "FOR UPDATE") does not attach a FOR UPDATE row lock in GORM v2, meaning the SELECT query runs without locking the row. The fix in PR #2399 replaces this with tx.Clauses(clause.Locking{Strength: "UPDATE"}), the correct GORM v2 API. CPE cpe:2.3:a:songquanpeng:one-api:*:*:*:*:*:*:*:* covers all versions up to 0.6.11-preview.7. CWE-840 (Business Logic Errors) describes the failure to enforce the invariant that a redemption code is single-use, which is the business contract being violated here. The 'Information Disclosure' tag in the intelligence data appears to be a misclassification - the actual impact is integrity loss (unauthorized quota credits), not disclosure.
RemediationAI
Upstream fix available via pull request #2399 (https://github.com/songquanpeng/one-api/pull/2399); this PR awaits acceptance and a released patched version has not been independently confirmed. Operators who require an immediate fix can apply the one-line patch manually: replace tx.Set("gorm:query_option", "FOR UPDATE").Where(...) with tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where(...) in model/redemption.go and rebuild. As a compensating control, applying rate limiting or per-user request deduplication at the API gateway or reverse proxy layer for the redemption endpoint reduces the exploitable concurrency window, though it does not eliminate the race entirely. If the redemption code feature is not actively used, disabling it at the application configuration level eliminates exposure with no functional trade-off. Monitor https://github.com/songquanpeng/one-api/pull/2399 for merge status before upgrading.
Same weakness CWE-840 – Business Logic Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today