Lab: Multi-endpoint race conditions
Summary: PortSwigger's lab describes a purchasing flow with a race condition that lets a user buy items at an unintended price, and asks the solver to buy a Lightweight L33t Leather Jacket using the account wiener:peter. The walkthrough identifies the cart endpoints (POST /cart to add items, POST /cart/checkout to submit the order) and shows that the first request in a sequence consistently takes longer than the second, a delay attributed to back-end network architecture rather than endpoint processing time.
What's compelling: The exploitable window sits between when the server validates an order and when it confirms it, so adding items after the store-credit check can push through an order the account could not otherwise afford. Any checkout that validates and confirms in a single request/response cycle carries the same exposure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026