Researcher demonstrates chaining missing rate limits with Math.random() predictability via race conditions to bypass 2FA OTP validation in a Node.js-based React-Native mobile application, combined with SQL injection in the OTP endpoint affecting multiple authentication flows.
A race condition vulnerability in a team management feature allows bypassing the free plan's 5-user invitation limit by sending simultaneous requests through Burp Intruder, enabling attackers to invite 22+ users without upgrading to a paid plan.
A detailed writeup of exploiting a race condition vulnerability in a referral invite system by sending multiple simultaneous requests using Turbo Intruder to register the same coupon code multiple times, bypassing the one-time-use restriction and multiplying rewards.
Educational article explaining race condition vulnerabilities in web applications, particularly in financial systems, with real-world examples including the Starbucks gift card exploit where attackers could generate unlimited credit by sending concurrent transfer requests to bypass balance checks.