PT-2026-37307 · Unknown · Parse Server

Adrgs · Published 2026-05-05 · Updated 2026-05-14 · CVE-2026-43930

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.76 Parse Server versions prior to 9.9.0-alpha.2

Description A race condition exists in the MFA SMS one-time password (OTP) login path. This allows two concurrent requests to the '/login' endpoint using the same OTP to both succeed and receive valid session tokens, which violates the single-use requirement of the OTP. For this to be exploited, an attacker must already have the victim's password and intercept the active SMS OTP through methods such as SIM swapping, network mirroring, or phishing relays, and then execute the request simultaneously with the legitimate user.

Recommendations Update to version 8.6.76. Update to version 9.9.0-alpha.2. Disable SMS MFA and use TOTP instead. Implement a rate limiter on the '/login' endpoint to reduce concurrent-request burst capacity.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BIT-PARSE-2026-43930

CVE-2026-43930

GHSA-JPQ4-7FMQ-Q5FJ

Affected Products

Parse Server

References · 8

• https://github.com/parse-community/parse-server/pull/10448 · Patch
• https://github.com/parse-community/parse-server/pull/10449 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jpq4-7fmq-q5fj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-43930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43930 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://t.me/CVEtracker/53513 · Telegram Post