Skip to content
OpenAdvisories

Product · songquanpeng

one-api

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.5
    CVE-2026-81027

    one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

    one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin s…

    songquanpeng one-api