CVE-2026-22820

CVE-2026-22820 affects Outray, an open-source ngrok alternative, prior to version 0.1.5. It's a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows users to bypass subscription limits and create more active tunnels than permitted. The vulnerability has a CVSS score of 3.7 (LOW), indicating a network-based attack with high attack complexity, but only a low impact on integrity and no impact on confidentiality or availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or media coverage, though it has garnered significant community discussion with 10 mentions.