CVE-2026-57959

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.9.1

Description A promo code validation issue exists where the system validates the usage count before the asynchronous UpdateEventStatisticsJob increments it. This allows attackers to redeem limited promo codes an unlimited number of times by sequentially reserving multiple orders with the same restricted promo code. Each request reads the order usage count as 0 and passes validation, enabling the completion of multiple orders at discounted prices without requiring concurrent requests.

Recommendations Update Hi.Events to a version newer than 1.9.0.