TI-2026-41725 Aliases CVE-2026-57959 GHSA-m75j-c5ff-9wh8

Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition

LOW 35CWE-367Published 2026-06-29 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00256 17th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HiEventsDev	Hi.Events	up to 1.9.0	—	No fix listed	CNA

Hi.Events VendorHiEventsDev Affected up to 1.9.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-57959
2026-10-03 Alias added: GHSA-m75j-c5ff-9wh8

References

Other 1

Researcher Disclosure

TI-2026-42835 Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint CVSS 4.0MEDIUM 6.9
TI-2026-41726 Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id CVSS 4.0HIGH 8.3
TI-2026-53674 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects CVSS 4.0HIGH 8.4
TI-2026-42836 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences