The vulnerability is a TTL index race condition in the /save endpoint of Alienbin. Each paste submission drops and recreates the MongoDB TTL index for the entire post collection with the TTL specified by the submitter. This concurrency flaw allows an attacker to submit pastes with a short TTL, which causes the index to apply that short expiration to all documents, deleting other users' pastes prematurely. The flaw manifests as a data loss event with no remote code execution or privilege escalation. The weakness is identified as CWE‑362, a race condition.

The affected product is Alienbin from Blue‑B, version 1.0.0 and all earlier releases that use the /save endpoint which recreates the TTL index on every request.

The CVSS score is 7.1, indicating a high severity of unauthorized data deletion. The EPSS score is less than 1 %, implying the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending HTTP POST requests to the /save endpoint with a ttlOption of 30 seconds or similar, and repeating this action to delete all pastes. Because the TTL index is recreated globally, any concurrent writes or reads in the database can be affected, making the exploit straightforward for users with network access to the service.