CVE-2026-57959

The record

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.

Affected packages

Related vulnerabilities

• CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
• CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
• CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367
• CVE-2026-119552 Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup… CWE-367
• CVE-2026-92374 A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link… CWE-367
• CVE-2026-117603 Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet… CWE-367
• CVE-2026-75524 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-367
• CVE-2026-105481 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a… CWE-367