Promo Code Validation Flaw in Hi.Events by Hi.Events Dev

CVE-2026-57959

What is CVE-2026-57959?

Hi.Events versions up to 1.9.0 exhibit a vulnerability in the promo code validation mechanism. This flaw allows attackers to bypass usage limits on promo codes, enabling them to redeem codes an unlimited number of times. The issue arises from a race condition between the validation of usage counts and the asynchronous increment of usage statistics. As a result, attackers can exploit this weakness to reserve multiple orders using the same promo code, effectively obtaining discounts on orders without appropriate limitations. This vulnerability poses significant risks to businesses relying on promo codes for sales and discounts, allowing fraudulent transactions through sequential reservations.

References