Is CVE-2026-57959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57959 being exploited in the wild.

How severe is CVE-2026-57959?

Medium severity, with a CVSS score of 5.9, published 29 June 2026.

Which products and versions are affected?

HiEventsDev Hi.Events through 1.9.0.

Is there a fix for CVE-2026-57959?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57959 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57959?

Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57959: HiEvents Hi.Events promo code usage limit bypass

CVE-2026-57959 · Severity: medium · CVSS 5.9 · Published 2026-06-29

Hi.Events, an event management and ticketing platform, contains a flaw in how it processes promotional codes. An attacker can use a single-use or limited-use discount code an unlimited number of times by placing multiple orders before the system updates its internal usage counter. This can lead to significant financial losses for event organizers as attendees bypass payment requirements or use unauthorized discounts.

Technologies: HiEventsDev Hi.Events. Vendors: HiEventsDev.

Quick answers

Is CVE-2026-57959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57959 being exploited in the wild.
How severe is CVE-2026-57959?: Medium severity, with a CVSS score of 5.9, published 29 June 2026.
Which products and versions are affected?: HiEventsDev Hi.Events through 1.9.0.
Is there a fix for CVE-2026-57959?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57959 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57959?: Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the promo code validation logic of Hi.Events. When an order is reserved, the system checks the 'order_usage_count' against the 'max_allowed_usages'; however, the counter is only incremented asynchronously via the 'UpdateEventStatisticsJob' after an order is fully completed. Because the 'CompleteOrderHandler' does not re-validate the promo code eligibility, an attacker can sequentially create multiple reservations using the same code while the counter remains stale. This allows for unlimited redemptions of restricted codes without requiring high-concurrency exploitation. The vulnerability is present in versions up to and including 1.9.0.

Affected products

HiEventsDev Hi.Events through 1.9.0

Timeline

2026-05-24: other: Vulnerability reported to vendor via email
2026-06-17: disclosed: Public issue opened on GitHub repository
2026-06-29: advisory: CVE published and added to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.