The issue is a time‑of‑check to time‑of‑use race condition that allows a user to create more tunnels than are permitted by their subscription. The counter that tracks active tunnels is updated in a non‑atomic way; when two tunnel Creation requests occur concurrently, both can pass the check before the counter is incremented, resulting in an over‑run of the tunnel quota. This resource abuse can lead to denial of service for other users or a breach of contractual limits.

The vulnerable product is Outray, an open‑source ngrok alternative developed by akinloluwami. Any installation of Outray older than version 0.1.5 is affected. The problem was fixed in 0.1.5 and later releases are immune.

The CVSS score of 6.3 indicates a medium severity. The EPSS metric is below 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or user‑level access to the Outray CLI, as the race condition is triggered by concurrent tunnel creation from an authorized session. Once exploited, the attacker can exhaust the tenant’s tunnel quota.