A critical race condition vulnerability in MedusaJS Medusa allows unauthenticated remote attackers to bypass promotional usage limits, creating significant risk for financial loss.

This is a race condition (time-of-check to time-of-use) within the registerUsage function of the promotion module. Unauthenticated remote attackers can exploit the non-atomic read-check-update logic by sending concurrent checkout requests to exceed set usage limits.

The exploitation of this flaw allows for the unauthorized redemption of promotional codes that should be limited in scope. Given the CVSS score of 8.1, this vulnerability poses a high risk to business revenue and integrity, as attackers can bypass financial controls to perform unlimited redemptions.

Immediate Action: Review the official MedusaJS repository for security patches or updates that address the race condition in the promotion module. If an official patch is not yet available, restrict access to the checkout process or disable promotional features until a fix is deployed.

Proactive Monitoring: Monitor server logs for high volumes of concurrent requests originating from single or multiple IP addresses targeting the checkout or promotion redemption endpoints.

Compensating Controls: Implement rate limiting on promotional code redemption endpoints to mitigate the impact of concurrent request bursts. Use a Web Application Firewall (WAF) to detect and block suspicious traffic patterns associated with automated checkout attempts.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the referenced security disclosure.

Organizations utilizing MedusaJS v2.12.2 or earlier must prioritize this issue due to its direct impact on financial controls. Administrators should monitor vendor channels for the release of a patched version and apply it immediately upon availability. Until then, enforcing strict rate limiting and monitoring for anomalous concurrent request patterns is essential to prevent financial abuse.