AIKIDO-2026-313712

TL;DR

A magic link created with a visit limit checks the counter and increments it in two separate steps rather than one atomic update. Concurrent requests against the same link can each pass the limit check before either increment is saved, so the link can be visited more times than the configured limit allows. Applications that leave the visit limit unset are not affected. The fix runs the limit check and increment as one atomic conditional database update.