GHSA-jpq4-7fmq-q5fj BIT-parse-2026-43930 CVE-2026-43930

parse-server: MFA SMS one-time password accepted twice under concurrent login

Medium npm

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.24%; Chance of exploitation in the next 30 days. Higher than 14.65% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Fix: 9.9.0-alpha.2; Upgrade parse-server to this version or later

Description

Impact

A race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow.

This advisory is the same class of incomplete fix as GHSA-2299-ghjr-6vjp (TOTP recovery codes) and GHSA-w73w-g5xw-rwhf (MFA recovery in authData-only login). Those previous fixes added optimistic locking only for array-typed authData fields; SMS MFA stores the OTP as a string, so the guard skipped it.

Patches

The optimistic lock has been generalized to cover primitive (string, number, boolean) and array authData fields. The lock is implemented as a shared helper applyAuthDataOptimisticLock that adds equality predicates on the original values of changed fields to the update WHERE clause. Concurrent writers racing the same single-use token now miss the WHERE condition and surface as Invalid auth data.

Workarounds

Disable SMS MFA and use TOTP instead (TOTP tokens are time-window validated, not stored single-use).
Place a rate limiter on the /login endpoint to reduce concurrent-request burst capacity.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10448
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10449

Affected versions

npm

Package	Vulnerable	Fixed in
parse-server	`>= 9.0.0, < 9.9.0-alpha.2`	`9.9.0-alpha.2`
parse-server	`< 8.6.76`	`8.6.76`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

parse-server npm → `9.9.0-alpha.2`

npm

npm install parse-server@9.9.0-alpha.2

yarn

yarn add parse-server@9.9.0-alpha.2

pnpm

pnpm add parse-server@9.9.0-alpha.2

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How to prevent it

Architecture and Design: In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design: Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design: Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Implementation: When using multithreading and operating on shared variables, only use thread-safe functions.
Implementation: Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Implementation: Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Implementation: Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Implementation: Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Implementation: Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-43930

Packages

github.com/parse-community/parse-server

Timeline

May 5, 2026 Published
Oct 26, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist	Low	Also affects parse-server
GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change	Low	Also affects parse-server
GHSA-v8x7-r927-cc93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist	Low	Also affects parse-server
GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query operators	High	Also affects parse-server
GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL	Medium	Also affects parse-server
GHSA-75v4-m273-5j49 parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied	Medium	Also affects parse-server
GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	Low	Also affects parse-server
GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests	Medium	Also affects parse-server

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor