PT-2026-2934 · Outray · Outray
Senseixenus
·
Published
2026-01-13
·
Updated
2026-02-28
·
CVE-2026-22819
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Outray versions prior to 0.1.5
Description
A flaw exists in Outray that allows a user, even those on a free plan, to obtain more subdomains than permitted due to missing database transaction locks. Specifically, the issue resides in the API endpoint
/api/$orgSlug/subdomains/index.ts. The code checks the user's plan and existing subdomains without proper transaction locking, creating a race condition. An attacker can exploit this by sending parallel requests to the endpoint. If a second request reads the subdomains table before the first request's INSERT statement completes, it can bypass the subdomain limit check and successfully create additional subdomains. The attack exploits the time window between reading and writing database rows. A proof of concept demonstrates the ability to create multiple subdomains in parallel using a tool like Burp Suite, exceeding the allowed limit.Recommendations
Versions prior to 0.1.5 should be updated to version 0.1.5 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Outray