Threats tagged 'ghsa-pgcq-8grm-5rx9'

Paymenter before version 1.5.5 contains a race condition in the payWithCredit() function where a database row lock is attempted without an active transaction. This allows concurrent payment requests to read the same credit balance simultaneously, enabling users to double-spend their credit balance across multiple invoices. The issue leads to financial loss as multiple invoices can be paid with the same credit balance. No patch is explicitly provided in the data.