CVE-2026-22819

Outray Race Condition: Bypassing Subscription Limits for Fun and Profit

Alon Barad
Alon Barad
Software Engineer

Jan 14, 2026·5 min read·3 visits

Executive Summary (TL;DR)

Outray failed to use atomic transactions when checking user limits. Attackers could send parallel requests to register subdomains. The server would check the limit for all requests simultaneously (seeing '0 used'), pass them all, and then insert them all. Fixed by implementing pessimistic row-level locking.

A critical race condition in the Outray project allowed users to bypass subscription plan limits. By flooding the API with concurrent requests, attackers could register unlimited subdomains and tunnels, effectively rendering the monetization model useless.

Fix Analysis (2)

Technical Appendix

CVSS Score
5.9/ 10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected Systems

Outray (apps/web component)Subdomain Registration APITunnel Registration API

Affected Versions Detail

Product
Affected Versions
Fixed Version
Outray
akinloluwami
< Commit 73e8a09Commit 73e8a09
AttributeDetail
CWE IDCWE-367 (TOCTOU)
Attack VectorNetwork (API)
CVSS v3.15.9 (Medium)
ImpactBusiness Logic Bypass
PrerequisitesAuthenticated User (Low Priv)
Exploit DifficultyLow (Scriptable)
CWE-367
Time-of-Check Time-of-Use (TOCTOU) Race Condition

The product checks the state of a resource before using it, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Vulnerability Timeline

Fix commit for tunnel registration pushed
2026-01-13
Fix commit for subdomain registration pushed
2026-01-13
GitHub Advisory GHSA-45hj-9x76-wp9g published
2026-01-13
CVE-2026-22819 assigned
2026-01-14

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.