Lab: Partial construction race conditions
Summary: PortSwigger's lab demonstrates a partial construction race condition in a user registration mechanism, where a race window between creating a pending user and validating the confirmation token lets an attacker bypass email verification and register with an arbitrary email address they do not own. The walkthrough uses Burp Suite 2023.9 or higher and Turbo Intruder's race-single-packet-attack template to line up the confirmation request inside that window, producing a 200 response reading 'Account registration for user <USERNAME> successful'.
Why it matters: The exploit hinges on a temporary sub-state where a null or empty-array token matches an uninitialized registration token, so a control that looks sound in sequential testing fails when two requests land in the same instant.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026