The race condition in Outray's subdomain creation endpoint allows a free plan user to create more subdomains than the service limits permit. By sending concurrent requests, the application’s missing database transaction locks enable duplicate allocations, leading to unauthorized subdomain provisioning. The exploit does not expose sensitive data but permits users to exceed quota, which can be used for resource abuse or to create misleading or malicious subdomains.

Outray, an open‑source ngrok alternative maintained by akinloluwami, is affected in all releases prior to version 0.1.5. The vulnerability was fixed in 0.1.5, so any deployment running an earlier version is vulnerable. The affected component is the subdomain creation route located at main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% shows that exploitation is currently unlikely. Because the flaw is triggered by concurrent web API calls from an authenticated free‑plan account, the attack vector is local to the application but requires legitimate user access. The vulnerability is not listed in CISA’s KEV catalogue, suggesting no known supply‑chain exploitation but still warrants prompt containment.