CVE-2026-57959 Details

A vulnerability exists in Hi.Events versions through 1.9.0, allowing unlimited redemption of limited-use promo codes. This issue arises because the application validates promo code usage counts before an asynchronous job updates the statistics, creating a race condition. Attackers can exploit this by reserving multiple orders with the same promo code, each order reflecting a usage count of zero and passing validation. Once reserved, these orders can be completed at discounted prices, without the need for concurrent requests.

It is recommended to re-validate promo codes, including their usage counts, in the order completion process before finalizing orders. Alternatively, promo code usage counts could be updated synchronously at the time of reservation and adjusted if an order is canceled or expires.