EUVD-2026-98552
GHSA-r82c-hj94-463x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege shopper
-
ExploitSend concurrent generateOrder requests reusing couponId
-
ExecutionWin TOCTOU race in redemption check
-
ImpactApply single coupon to multiple orders
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated low-privilege account on the mall application (PR:L) and that the Coupon Redemption feature / coupon flow through /order/generateOrder is in use. The attacker must issue parallel requests reusing the same couponId and win a narrow time-of-check/time-of-use window, which the vendor rates as high-complexity and 'difficult' (AC:H) - the primary limiting factor. Impact is confined to integrity (coupon double-redemption, VI:L); there is no path to confidentiality or availability impact, no code execution, and no unauthenticated access. |
| Impact | This is a low-priority issue that scores low on virtually every available signal. The CVSS 4.0 base score is only 2.3, driven by AV:N (network reachable) but tempered heavily by AC:H (high attack complexity), PR:L (requires an authenticated low-privilege account), and an impact limited to VI:L (low integrity impact) with no confidentiality or availability impact (VC:N/VA:N). The vendor-assigned narrative reinforces this: the attack 'requires a high level of complexity' and exploitability is 'assessed as difficult' - consistent with a race-condition (CWE-362) TOCTOU window that is hard to win reliably. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting; nothing here elevates it beyond its low CVSS. One notable non-technical signal: the vendor deleted the GitHub issue without explanation, which creates uncertainty about whether a fix exists and whether affected-version data is reliable. Net: a genuine but low-severity, hard-to-exploit integrity bug, not an urgent priority. |
| Exploit ScenarioDerived | An authenticated user with a valid shopping account sends many concurrent /order/generateOrder requests reusing the same couponId, racing the coupon-redemption check so the same coupon is validated and applied across multiple orders before its used-state is committed. Success yields duplicate redemption (e.g. applying a single-use coupon more than once), but only a low integrity impact and only if the attacker wins a narrow timing window. No public proof-of-concept exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Race condition in the coupon redemption flow of macrozheng mall through version 1.0.3 allows an authenticated low-privilege user to issue parallel requests to /order/generateOrder reusing the same couponId and win a narrow time-of-check/time-of-use window, redeeming a single coupon more than once. The impact is confined to integrity - coupon double-redemption - with no confidentiality or availability effect, no code execution, and no unauthenticated path; the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the vendor-supplied CVSS 4.0 base score of 2.3. Exploitation is difficult due to the required request timing, no public exploit code has been identified, and there is no confirmed active exploitation (not in CISA KEV), making this a low-priority finding.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis: the upstream GitHub issue (https://github.com/macrozheng/mall/issues/1003) was reportedly deleted by the vendor without explanation, and no fixed version number appears in the advisory set (https://github.com/macrozheng/mall/, https://vuldb.com/cve/CVE-2026-109407, https://vuldb.com/vuln/416949). Until a fix is confirmed, apply compensating controls aimed at the race itself rather than the endpoint generally: enforce single-use redemption at the data layer with a unique constraint or atomic conditional update on the redemption record keyed by (user_id, coupon_id) or an idempotency/request key, which closes the TOCTOU window regardless of application-level threading - the trade-off is that any legacy duplicate redemption rows must be cleaned up first or writes will fail; alternatively serialize coupon writes with a per-coupon row lock (SELECT ... FOR UPDATE) or an optimistic-locking version column, which eliminates the race but reduces checkout throughput under concurrent load and can surface deadlocks if lock ordering is inconsistent; add per-user request throttling or a short-lived deduplication cache keyed on couponId, which is a cheaper stop-gap but only narrows the window rather than eliminating it. Do not simply block /order/generateOrder at the network layer, as that disables order creation entirely; if coupon double-redemption risk is unacceptable and no code change can be made, disabling the coupon redemption feature is the only reliable mitigation, at the cost of the promotional functionality. Monitor order logs for repeated couponId usage within the same second as a detection heuristic, and re-check the vendor repository for a commit or tagged release that addresses coupon redemption concurrency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic concurrency defect, CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), manifesting as a time-of-check/time-of-use race in the Coupon Redemption component reached through the /order/generateOrder endpoint of the macrozheng mall e-commerce application. When an order is generated with a couponId parameter, the application appears to validate coupon eligibility and remaining validity before committing the redemption, without serializing concurrent requests that reference the same coupon; two or more near-simultaneous requests can therefore each pass the check and both commit, producing a double redemption. The vulnerability requires authentication with a low-privileged account (PR:L in the assessed vector) and a high degree of timing precision (AC:H), which the vendor itself characterizes as 'difficult' to exploit. No CPE strings were supplied with the intelligence feed, so the exact affected artefact set is limited to the macrozheng mall project referenced by the vendor repository link; there is no evidence of a memory-safety, injection, or deserialization primitive, and the defect is purely a state-consistency problem inside an otherwise legitimate business workflow.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable but needs an authenticated account (PR:L) and winning a hard-to-trigger race (AC:H); impact is limited integrity (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB