CVE-2024-45300

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.

• CWE-362
• CWE-362

• https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245Patch
• https://github.com/alfio-event/alf.io/security/advisories/GHSA-67jg-m6f3-473gExploit, Vendor Advisory

Published

Sep 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45295Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45296path-to-regexp turns path strings into a regular expressions…7.5
• CVE-2024-45297Discourse is an open source platform for community discussio…4.3
• CVE-2024-45298Wiki.js is an open source wiki app built on Node.js. A disab…4.3
• CVE-2024-45299alf.io is an open source ticket reservation system for confe…6.5
• CVE-2024-4530The Business Card WordPress plugin through 1.0.0 does not ha…6.3
• CVE-2024-45301Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In …5.3
• CVE-2024-45302RestSharp is a Simple REST and HTTP API Client for .NET. The…7.8
• CVE-2024-45303Discourse Calendar plugin adds the ability to create a dynam…6.1
• CVE-2024-45304Cairo-Contracts are OpenZeppelin Contracts written in Cairo …6.5
• CVE-2024-45305gix-path is a crate of the gitoxide project dealing with git…2.5
• CVE-2024-45306Vim is an open source, command line text editor. Patch v9.1.…5.5