Race condition / TOCTOU
A vulnerability where state changes between when a program CHECKS something and USES it (Time-Of-Check to Time-Of-Use). The attacker exploits the tiny time window to sneak in a change after the check but before the use.
Classic example: a program checks "does this user have the right to read file X?" (check), and then opens X (use). Between the two steps the attacker swaps X for a symlink to a secret file → the check applied to the harmless file, but the use hits the secret one. More generally: any "check-then-act" sequence without atomicity can be exploited if an attacker can change the state in the window. Other cases: double withdrawals from a balance (check balance, deduct — run twice in parallel), filesystem TOCTOU, and races in authentication. Defense: make the operation atomic (open the file and check the opened handle, not the path), use locks/transactions, and avoid relying on the state being unchanged between steps. A subtle but serious class of bug. Related to IDOR and insecure deserialization.