[UNLIMITED BILLING BUG] Restrict accept invite team member concurrency

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Somewhere else…

Describe the Bug

Bad actors can create multiple accounts (Admin Standard/Premium, Member Standard/Premium) and then accept the invite link simultaneously.

The current request limit is 5, but this used to be unlimited before it was half patched (to my knowledge).

Currently, many bad actors are abusing this concurrency bug to profit financially (In Chinese black market, and this methods had been leaked).

Since an open invoice remains valid for 7 days (with automatic payment retries) before turning into “unpaid,” the damage is already done by the time the invoice and subscription expires.

A recommend fixure is to limit the concurrent to 1 or convert to synchronous request.

Steps to Reproduce

  1. Create a new team ($40/mo)
  2. Create invite link
  3. Prepare 5+ account (plan type doesn’t matter, even Free/Start works)
  4. Write a script to accept the invite link concurrently (/api/accept-invite)
  5. Profit

Expected Behavior

Only 1 account should be accepted (due to the seat limit).

All other requests should either receive a 429 error or be queued sequentially.

Operating System

Other

Version Information

(Since this is a web api problem, no version required)

Additional Information

For others that is trying to abusing this kind of bug, stop right now, and don’t ever trying to damage Cursor becuase it will make people more hated about this kind of behaviour.

Does this stop you from using Cursor

Yes - Cursor is unusable

4

I’m here to request that someone notify the billing team to fix this kind of issue. Thank you.

@kevinn @deanrie

8

Hi @Henry_Criss Thank you for the post, we are aware of this! I have unlisted it for privacy, but we appreciate you flagging this.

9

Hi @kevinn @deanrie , any update about this bug fixture?

There are still so many people abusing this bug today.

10

This seems to be linked to the black market for credit cards in the US; as far as I know, people in China aren’t really in the habit of using credit cards.

11

Please don’t mislead the team in the wrong direction.
This is not about payment method & market linking; this is a pure bug report.

12

It has been 2 days since the report—has this bug been fixed yet, or is there any progress?
I still see people abusing this bug to gain profit, and there are even services that exist solely for exploiting this bug.

@kevinn @deanrie

13

It has been 4 days since this report, and there is already a market abusing this bug widely.

Is there an ETA for this issue? Thank you.

@moderators