PT-2026-53677 · Hieventsdev · Hi.Events

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-57959

NVD

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order usage count=0 and passing validation, then complete them all at discounted prices without concurrent requests.

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

CVE-2026-57959

Produtos afetados

Hi.Events

Referências · 3

• https://github.com/HiEventsDev/Hi.Events/issues/1223 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57959 · Nota de Segurança
• https://vulncheck.com/advisories/hi-events-promo-code-max-usage-bypass-via-asynchronous-job-race-condition · Nota