PT-2026-53677 · Hieventsdev · Hi.Events

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57959

NVD

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order usage count=0 and passing validation, then complete them all at discounted prices without concurrent requests.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-57959

Affected Products

Hi.Events

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-57959 · Security Note
• https://github.com/HiEventsDev/Hi.Events/issues/1223 · Note
• https://vulncheck.com/advisories/hi-events-promo-code-max-usage-bypass-via-asynchronous-job-race-condition · Note