CVE-2026-43930

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43930
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow. This vulnerability is fixed in 8.6.76 and 9.9.0-alpha.2.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/pull/10448 Issue Tracking Patch
https://github.com/parse-community/parse-server/pull/10449 Issue Tracking Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.9.0:alpha1:*:*:*:node.js:*:*
History

26 May 2026, 16:39

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/pull/10448 - () https://github.com/parse-community/parse-server/pull/10448 - Issue Tracking, Patch
References () https://github.com/parse-community/parse-server/pull/10449 - () https://github.com/parse-community/parse-server/pull/10449 - Issue Tracking, Patch
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj - () https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj - Mitigation, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.9.0:alpha1:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server

12 May 2026, 14:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-12 14:17

Updated : 2026-05-26 16:39

NVD link : CVE-2026-43930

Mitre link : CVE-2026-43930

CVE.ORG link : CVE-2026-43930

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')