Skip to content

Race Condition (TOCTOU) Allows Multiple Account Creation from Single Invitation Token

Moderate
gantoine published GHSA-wh3g-54gh-jcvh Jan 9, 2026

Package

No package listed

Affected versions

<=4.4.1

Patched versions

>=4.5.0

Description

Summary

A race condition in the invite token flow allows a single invite token (intended for one-time use) to be consumed multiple times when concurrent registration requests are made. This enables creation of multiple accounts from one invitation.

Affected Version: 4.4.1 (latest Docker image at time of testing - November 2025)


PoC

[REDACTED]


Impact

Bypasses single-use invitation restriction, allowing creation of multiple accounts from one token via race condition.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. Learn more on MITRE.

Credits