Executive brief
One-api is a management system used to distribute and manage access keys for various Large Language Model (LLM) services. A security flaw in the redemption code system allows a single-use top-up code to be used multiple times if processed simultaneously. This could allow users to unfairly inflate their account balances, leading to financial loss for the service provider.
Technical details
A race condition exists in the 'Redeem' function within 'model/redemption.go' of songquanpeng one-api. When using a MySQL backend, the Redemption Code Top-Up Endpoint fails to properly handle concurrent requests, allowing a single redemption code to be processed multiple times before its status is updated in the database. An authenticated remote attacker can exploit this by sending simultaneous redemption requests to artificially increase their account balance. While a pull request (PR #2399) has been submitted to address the logic error, it remains unmerged in the affected version range.
Affected products
- songquanpeng one-api >= 0.1.6-alpha, <= 0.6.11-preview.7
Timeline
- 2026-05-19: other: Issue reported and fix proposed via pull request
- 2026-06-07: advisory: NVD publication date
- 2026-06-08: disclosed: GitHub Advisory published