A library voucher system is meant to redeem each code once, but simultaneous requests appear to redeem the same voucher twice. What finding class does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Two people racing through the same turnstile at once can both get in if the gate only checks after the fact. Concurrent redeems of a single-use voucher are classic race/business-logic issues — no SQLi required. DNS or cert quirks are a different conversation.
Full Explanation
Race conditions and related business-logic flaws can defeat financial or process controls when the application fails to enforce atomic, server-side checks under concurrency. Testers should recognize this class separately from injection, DNS, or TLS issues. CSRF tokens address cross-site request forgery, not all race windows. Report impact against the intended one-time redeem control and recommend atomic validation patterns.