EUVD-2026-41963Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated client required (PR:L); race condition demands concurrent request timing (AC:H); impact is limited integrity only, no confidentiality or availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests before any single request completes the usage increment, a client can obtain unlimited discounted or free orders from a single-use or limited-use promo code. Version 0.8.0 patches the issue. Some workarounds are available. Disable promo codes entirely until a patch is available or monitor the promo table for used values exceeding maxuses and manually review affected orders.
AnalysisAI
Race condition in FOSSBilling's cart checkout flow allows authenticated clients to exploit promo codes beyond their configured usage limits by submitting concurrent checkout requests. Affected versions prior to 0.8.0 fail to atomically check and increment promo code usage counts (CWE-367), enabling a single limited-use or one-time-use code to be redeemed unlimited times. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the attack is straightforward to automate for any authenticated user with knowledge of a valid promo code.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client management platform. The affected component is the cart checkout flow, where the system checks a promo code's current usage count against its configured maximum (maxuses) and then increments the usage counter as a non-atomic operation. This is a classic Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367): multiple concurrent requests can pass the usage-limit check before any single request completes the increment, because the read and write to the promo table are not protected by a mutex, transaction lock, or database-level atomic increment. Version 0.8.0 patches the issue, likely by introducing atomic database operations or transaction isolation. The CVSS 4.0 vector supplied (AV:N/AC:L/AT:N/PR:N) conflicts with the description's explicit requirement for an authenticated client - this is a notable data quality issue.
RemediationAI
Vendor-released patch: FOSSBilling 0.8.0 addresses this vulnerability and operators should upgrade immediately. For deployments that cannot upgrade promptly, two workarounds are documented: first, disable promo codes entirely through the admin panel until the upgrade is applied - this eliminates the attack surface at the cost of losing promotional functionality; second, monitor the promo database table for rows where the 'used' column exceeds 'maxuses' and manually review and reverse affected orders, though this is a detective control rather than a preventive one and relies on timely human review. A database-level workaround such as adding a CHECK constraint or using SELECT FOR UPDATE in the checkout transaction may also be feasible for operators with direct database access, but this requires careful testing. Advisory reference: https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-w898-cx35-25gh.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today