Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-jsgf-t1ga-x7eq
Vulnerability ID VCID-jsgf-t1ga-x7eq
Aliases CVE-2026-43930
GHSA-jpq4-7fmq-q5fj
Summary parse-server: MFA SMS one-time password accepted twice under concurrent login ### Impact A race condition in the MFA SMS one-time password (OTP) login path allows two concurrent `/login` requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow. This advisory is the same class of incomplete fix as [GHSA-2299-ghjr-6vjp](https://github.com/parse-community/parse-server/security/advisories/GHSA-2299-ghjr-6vjp) (TOTP recovery codes) and [GHSA-w73w-g5xw-rwhf](https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf) (MFA recovery in authData-only login). Those previous fixes added optimistic locking only for array-typed authData fields; SMS MFA stores the OTP as a string, so the guard skipped it. ### Patches The optimistic lock has been generalized to cover primitive (string, number, boolean) and array authData fields. The lock is implemented as a shared helper `applyAuthDataOptimisticLock` that adds equality predicates on the original values of changed fields to the update WHERE clause. Concurrent writers racing the same single-use token now miss the WHERE condition and surface as `Invalid auth data`. ### Workarounds - Disable SMS MFA and use TOTP instead (TOTP tokens are time-window validated, not stored single-use). - Place a rate limiter on the `/login` endpoint to reduce concurrent-request burst capacity. ### Resources - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj - Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10448 - Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10449
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2026-43930
cvssv3.1_qr LOW https://github.com/advisories/GHSA-jpq4-7fmq-q5fj
cvssv4 2.1 https://github.com/parse-community/parse-server
generic_textual LOW https://github.com/parse-community/parse-server
cvssv4 2.1 https://github.com/parse-community/parse-server/pull/10448
generic_textual LOW https://github.com/parse-community/parse-server/pull/10448
ssvc Track https://github.com/parse-community/parse-server/pull/10448
cvssv4 2.1 https://github.com/parse-community/parse-server/pull/10449
generic_textual LOW https://github.com/parse-community/parse-server/pull/10449
ssvc Track https://github.com/parse-community/parse-server/pull/10449
cvssv3.1_qr LOW https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
cvssv4 2.1 https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
generic_textual LOW https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
cvssv4 2.1 https://nvd.nist.gov/vuln/detail/CVE-2026-43930
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-43930
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-43930
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/pull/10448
https://github.com/parse-community/parse-server/pull/10449
https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
https://nvd.nist.gov/vuln/detail/CVE-2026-43930
GHSA-jpq4-7fmq-q5fj https://github.com/advisories/GHSA-jpq4-7fmq-q5fj
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/pull/10448
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:27:09Z/ Found at https://github.com/parse-community/parse-server/pull/10448
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/pull/10449
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:27:09Z/ Found at https://github.com/parse-community/parse-server/pull/10449
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:27:09Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-43930
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01113
EPSS Score 0.0001
Published At June 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:00:51.986971+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jpq4-7fmq-q5fj/GHSA-jpq4-7fmq-q5fj.json 38.6.0