Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent login
Low 2.1
In plain English
A low-severity race condition in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow. This vulnerability is fixed in 8.6.76 and 9.9.0-alpha.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | parse-server | 9.9.0-alpha.2 | GHSA-jpq4-7fmq-q5fj |
| npm | parse-server | 8.6.76 | GHSA-jpq4-7fmq-q5fj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | >= 9.0.0, < 9.9.0-alpha.2< 8.6.76 |
Weakness: CWE-362 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj x_refsource_CONFIRM
- https://github.com/parse-community/parse-server/pull/10448 x_refsource_MISC
- https://github.com/parse-community/parse-server/pull/10449 x_refsource_MISC