AIKIDO-2026-830379

TL;DR

Several authentication flows retrieved and consumed one-time tokens and codes without serializing concurrent requests for the same account. Concurrent requests could reuse a single-use credential or exceed the configured OTP and SMS failure limits, because the token lookup and deletion were not performed under a locking transaction. Exploitation requires possession of a valid token or partial account access together with a concurrent request from the legitimate user. The fix wraps these operations in transactions using row locking, verifies that a single row was deleted, and rejects concurrent password updates instead of silently succeeding.