PT-2026-7635 · Medusajs · Medusajs

Published 2026-02-11 · Updated 2026-02-12 · CVE-2025-69871

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MedusaJS versions prior to 2.12.2

Description A race condition exists in the registerUsage() function within the promotion module. This function uses a non-atomic read-check-update process when managing promotion usage limits. This allows unauthenticated remote attackers to bypass these limits by sending multiple, simultaneous checkout requests. Successful exploitation can lead to unlimited redemptions of limited-use promotional codes and potential financial loss.

Recommendations Update to a version later than 2.12.2.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-69871

Affected Products

Medusajs

References · 9

• 🔥 https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69871-MedusaJS-TOCTOU.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69871 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69871 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69871 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69871 · Security Note
• https://github.com/medusajs/medusa/pull/13760 · Note
• https://github.com/medusajs/medusa · Note
• https://twitter.com/TheHackerWire/status/2022013454819938631 · Twitter Post