Race condition (TOCTOU) on OAuth2 authorization_code redemption: concurrent requests all get 200
Submitted
Concurrent redemption of the same OAuth2 authorization_code returned 200 to every request in the batch instead of rejecting all but the first, which breaks the single-use guarantee of the code and opens the door to replaying the exchange across sessions.
Outcome
| Field | Value |
|---|---|
| Submission | SALTOSYSTEMS-2RN028N1 |
| Submitted | 2026-10-07 |
| State | Closed — informative |
| CVSS (as submitted) | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| Bounty | None — not paid |
Triager verdict: "...marked it as informative — exploiting it requires first obtaining the victim's authorization code; the only realistic interception paths involve a compromised device, malicious browser extension, or physical access... no realistic attacker gain."
What I take from it
This is the most useful rejection I have received, because the argument is airtight: the bug is real, the precondition is the whole vulnerability. If the attack needs the victim's code in hand, the race adds impact only in a threat model the program does not defend against.
Rule I now apply before submitting anything with a precondition: write the attacker's first step as a sentence. If that sentence is "first compromise the victim's device", the finding is informative no matter how clean the race is.
Technical note
The measurement stands: n concurrent requests, all 200, no 409/400 on the losing requests. One code, many tokens. Real behaviour, insufficient threat model.