CVE-2026-43930
LOW EPSS 14.5%
Published May 12, 20261mo ago · Modified Jun 17, 20261w ago
2.1 CVSS 4.0
Published May 12, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow. This vulnerability is fixed in 8.6.76 and 9.9.0-alpha.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
14.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-362
Affected Products 3
| Vendor | Product | Version | Range |
|---|---|---|---|
| parseplatform | parse-server | * | <8.6.76 |
| parseplatform | parse-server | * | ≥9.0.0 – <9.9.0 |
| parseplatform | parse-server | 9.9.0 | any |
References 3
- github.com https://github.com/parse-community/parse-server/pull/10448
- github.com https://github.com/parse-community/parse-server/pull/10449
- github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
Remediation
- github.com https://github.com/parse-community/parse-server/pull/10448
- github.com https://github.com/parse-community/parse-server/pull/10449