CVE-2025-69871 - Vulnerability Analysis

Overview

MedusaJS Medusa <= 2.12.2 contains a race condition caused by non-atomic read-check-update in registerUsage() of the promotion module, letting unauthenticated remote attackers bypass usage limits, exploit requires concurrent checkout requests.

Severity & Score

Impact

Attackers can bypass promotion usage limits, enabling unlimited redemptions and causing potential financial loss.

Mitigation

Update to a version later than 2.12.2 or the latest available version.

References

• https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69871-MedusaJS-TOCTOU.md
• https://github.com/medusajs/medusa
• https://github.com/medusajs/medusa/pull/13760

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 13, 2026

🟠 CVE-2025-69871 - High (8.1) A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69871/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner