Race condition: single-use magic link & login token can be redeemed concurrently

Vulnerability Summary: Single-Use Magic Links and Login Tokens Can Be Redeemed Concurrently, Invalidating Single-Use Guarantee Overview Vulnerability Type: Logic vulnerability (race condition / failure in concurrent control) Core Issue: Single-use magic links and login tokens can be redeemed concurrently multiple times. only validates that the token is valid and not revoked, but the revocation operation does not take effect before the transaction is committed, allowing multiple concurrent requests to pass validation. CVSS 3.1: 6.8 / 10 (Medium) CWE: CWE-367 (TOCTOU Race Condition) Affected Versions Affected Versions: - Magic link read path: (introduced in ) through , and through - Magic link creation path: through , and through - Password login tokens: through , and through - WebAuthn login tokens: through Fixed in: and Impact: A party holding a single-use token can redeem it concurrently with the intended holder, breaking the single-use guarantee; attackers can obtain tokens via man-in-the-middle attacks, forwarded emails, link prefetchers, proxies, or browser history. Fix Details Root Fix: Make the revocation operation the serialization point by completing it within a transaction, preventing concurrent redemptions from bypassing it. Interim Mitigations (if immediate upgrade is not possible): - In 5.0 release candidates, set to to inadvertently serialize revocation via atomic insertion (side effect: the affected path becomes an out-of-design path, and this mitigation is ineffective for 4.x). - Shorten token validity periods to reduce the concurrent window. - If the concern is malicious scanners rather than attackers, configure the email platform to not forward authentication emails, eliminating common accidental scenarios. Key Code (SQL conditional update in the fix) > Note: This statement marks the token as if it already exists, thereby completing revocation within the transaction and avoiding the TOCTOU race condition. Additional Notes This vulnerability is not about forged access, sequential replay, or reproducing the original report; this code path does not exist in the ETS data layer. The original report scored 8.1, but this vulnerability is rated 6.8 (Medium) because the attacker must first obtain a valid, non-expired token.

Goal Reached Thanks to every supporter — we hit 100%!

Race condition: single-use magic link & login token can be redeemed concurrently

More from this source