PT-2026-26160 · Unknown · Parse Server

Fancymalware · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-32943

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.28 and 8.6.48

Description Parse Server, an open-source backend deployable on Node.js infrastructures, has an issue in its password reset mechanism. The system does not guarantee single-use tokens for password resets. An attacker intercepting a reset token can potentially race a legitimate user's password reset request, successfully changing the password to one controlled by the attacker. This could lead the legitimate user to believe their password change was successful, while the attacker gains access. The issue affects all Parse Server deployments utilizing the password reset feature. The password reset token is now atomically validated and consumed as part of the password update operation in versions 9.6.0-alpha.28 and 8.6.48. The database query that updates the password includes the reset token as a condition, ensuring that only one concurrent request can successfully consume the token.

Recommendations Parse Server versions prior to 9.6.0-alpha.28 should be upgraded. Parse Server versions prior to 8.6.48 should be upgraded.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BIT-PARSE-2026-32943

CVE-2026-32943

GHSA-R3XQ-68WH-GWVH

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32943.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-r3xq-68wh-gwvh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32943 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32943 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32943 · Security Note
• https://osv.dev/vulnerability/GHSA-r3xq-68wh-gwvh · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10216 · Note
• https://github.com/parse-community/parse-server/pull/10217 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2034520414500618562 · Twitter Post