Summary
A race condition in the invite token flow allows a single invite token (intended for one-time use) to be consumed multiple times when concurrent registration requests are made. This enables creation of multiple accounts from one invitation.
Affected Version: 4.4.1 (latest Docker image at time of testing - November 2025)
PoC
[REDACTED]
Impact
Bypasses single-use invitation restriction, allowing creation of multiple accounts from one token via race condition.
Summary
A race condition in the invite token flow allows a single invite token (intended for one-time use) to be consumed multiple times when concurrent registration requests are made. This enables creation of multiple accounts from one invitation.
Affected Version:
4.4.1(latest Docker image at time of testing - November 2025)PoC
[REDACTED]
Impact
Bypasses single-use invitation restriction, allowing creation of multiple accounts from one token via race condition.