Race Condition Flaw Let Single-Use Discount Code Be Redeemed 40 Times

A penetration testing team discovered a critical race condition vulnerability in an e-commerce checkout flow that automated security scanners had rated as low-risk. The flaw allowed a single-use 50% discount code to be redeemed 40 times in under a second by sending concurrent requests before the system could invalidate the code. The vulnerability stems from a 'check-then-act' pattern where the steps to validate a code and mark it as used are two separate operations rather than one atomic action. Standard automated scanners cannot detect such flaws because they send requests sequentially, meaning the exploitable window between concurrent requests never appears during testing. Security researchers note that any business logic involving coupons, referral bonuses, balance withdrawals, votes, or limited inventory is potentially susceptible to this class of attack.