What is the CVSS score of CVE-2025-69871?

CVE-2025-69871 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of MedusaJS Medusa are affected by CVE-2025-69871?

A race condition vulnerability in MedusaJS Medusa's promotion module allows attackers to bypass usage limits on promotional codes, potentially causing unlimited redemptions and significant revenue…

How to fix or mitigate CVE-2025-69871?

Within 24 hours: Disable promotional features if business-critical or implement database-level locking on promotion usage tables; audit recent promotion redemption logs for anomalies. Within 7 days: Deploy compensating controls (WAF rules blocking suspicious bulk redemption patterns, API rate limiting on promotion endpoints); conduct forensic review of promotion transaction history for exploitation evidence. Within 30 days: Upgrade to patched version once released; implement automated monitoring for concurrent promotion validation attempts.

MedusaJS Medusa CVE-2025-69871

HIGH

Race Condition (CWE-362)

2026-02-11 cve@mitre.org

Race Condition

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 19:15 nvd

HIGH 8.1

DescriptionNVD

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss.

AnalysisAI

Technical ContextAI

Classified as CWE-362 (Race Condition). A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss.

Affected ProductsAI

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function per

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-69871 vulnerability details – vuln.today

Back

MedusaJS Medusa CVE-2025-69871

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code