CVE-2026-43930: parse-server Vulnerability in MFA SMS OTP Handling
Summary
CVE-2026-43930: parse-server: MFA SMS one-time password accepted twice under concurrent login. Affects parse-server across 2 version ranges.
< 8.6.76
>= 9.0.0, < 9.9.0-alpha.2
Fixed in 8.6.76 or 9.9.0-alpha.2, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-43930 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with features such as user authentication, data storage, and real-time notifications. It is widely used for mobile and web applications, providing a robust platform for managing backend services. However, it has a vulnerability related to its Multi-Factor Authentication (MFA) SMS one-time password (OTP) mechanism, which can lead to security breaches if not addressed.
Vulnerability Detail
A race condition exists in the MFA SMS OTP login process that allows two concurrent login requests using the same OTP to both succeed. This undermines the single-use property of the OTP, potentially allowing an attacker who has the victim's password and can intercept the OTP to gain unauthorized access. The vulnerability arises from the lack of proper locking mechanisms for string-type authData fields, which allows concurrent requests to bypass security checks.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.768.6.76npm install parse-server@8.6.76 -
>= 9.0.0, < 9.9.0-alpha.29.9.0-alpha.2npm install parse-server@9.9.0-alpha.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can disable SMS MFA and switch to Time-based One-Time Password (TOTP) authentication, which does not store single-use tokens. Additionally, implementing a rate limiter on the /login endpoint can help reduce the risk of concurrent requests. Here is an example of a simple rate limiter implementation:
const rateLimit = require('express-rate-limit');
const loginLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // limit each IP to 100 requests per windowMs
});
app.post('/login', loginLimiter, (req, res) => {
// login logic here
});
Conclusion
The CVE-2026-43930 vulnerability in parse-server poses a risk to applications utilizing SMS MFA for authentication. It is crucial to update to the patched versions or implement workarounds to safeguard against potential unauthorized access. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for parse-server →
FAQ
CVE-2026-43930 is a vulnerability in the parse-server related to the handling of Multi-Factor Authentication (MFA) SMS one-time passwords, allowing concurrent login requests to succeed with the same OTP.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If exploited, this vulnerability can allow unauthorized access to user accounts, as attackers can use the same OTP for multiple login attempts, compromising the security of the application.
If immediate updates are not possible, consider disabling SMS MFA and implementing rate limiting on the login endpoint as a temporary workaround to mitigate the risk.
The CVSS score of this vulnerability is 2.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
