one-api EUVD-2026-66603

Exploitation requires possession of any valid one-api API token, including tokens issued to low-privilege or standard user accounts - this is the sole credential gate on the vulnerable route. The attack targets the URL path parameter channel-pinning endpoint in the one-api API, which is reachable over the network by any token holder. No admin role, group membership, or special configuration is required beyond token validity. Completely unauthenticated access is not possible: the route does sit behind token authentication. The attacker must be able to send HTTP requests to the one-api instance's API. The attack is most impactful in multi-tenant deployments where multiple operator-configured channels with distinct provider keys exist and where channel IDs (sequential integers) are enumerable - both of which are normal operating conditions for one-api. Per-group channel restrictions and per-channel model allowlists provide no limiting protection once a valid token is presented.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) accurately models the threat: network-accessible, low complexity, requiring only a low-privilege token, with high confidentiality impact on the vulnerable system and high subsequent-system confidentiality impact representing exposure of the operator's upstream provider accounts. PR:L is the critical limiting factor - completely unauthenticated exploitation is not possible, but in multi-tenant one-api deployments tokens are distributed to end users by design, making the effective attacker pool potentially large. The SC:H subsequent-system impact is significant: an attacker can consume provider quota, incur operator billing costs, and access AI model tiers or capabilities outside their authorization tier. VI:L reflects the model allowlist bypass, which may have compliance or policy implications. No CISA KEV listing and no public exploit code appear in the provided data, so exploitation status is unconfirmed; however, the attack primitive (HTTP request with incremented integer path parameter) is so straightforward that independent rediscovery requires no specialized skill, making the effective exploit barrier very low despite the absence of published PoC.

An attacker holding any valid low-privilege one-api API token sends HTTP requests to the channel-pinning URL path parameter endpoint, iterating integer channelid values (e.g., 1, 2, 3...) until a valid channel responds. For each valid channel discovered, the server transparently forwards the attacker's AI inference request using the operator's stored upstream provider API key for that channel, granting the attacker access to provider accounts, quota, and model tiers they were never authorized to use. No public exploit code has been identified, but the integer enumeration requires no special tooling beyond a standard HTTP client.