Race conditions
Summary: PortSwigger Research describes race conditions as vulnerabilities where websites process requests concurrently without adequate safeguards, letting multiple threads collide on the same data during a brief "race window" that can be as short as milliseconds. The research, first presented at Black Hat USA 2023, covers limit overruns such as reusing a one-time discount code, plus hidden multi-step sequences like an MFA workflow that briefly holds a valid session before enforcement, and it introduces Burp Suite's single-packet attack, which completes 20-30 requests in one TCP packet to neutralize network jitter.
Why it matters: The race window is often just milliseconds, and a single request can pass through a sub-state where MFA is not yet enforced, so an attacker sending a login request alongside a request to a sensitive authenticated endpoint can slip past the check entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026