Password Reset Token Bypass in Parse Server: A Critical Security Flaw
Summary
GHSA-r3xq-68wh-gwvh: Parse Server has a password reset token single-use bypass via concurrent requests. Affects parse-server across 2 version ranges.
< 8.6.48
>= 9.0.0, < 9.6.0-alpha.28
Fixed in 8.6.48 or 9.6.0-alpha.28, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications without the need for a custom server. It provides features such as data storage, user authentication, and real-time notifications. However, a vulnerability has been identified in its password reset mechanism, which allows attackers to exploit the system by bypassing single-use guarantees for reset tokens.
Vulnerability Detail
The vulnerability arises from the password reset mechanism in Parse Server, which does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests. This flaw allows an attacker who intercepts a reset token to race against the legitimate user's request, leading to both requests being processed successfully. Consequently, the legitimate user may believe their password has been changed, while the attacker's password takes effect instead. This vulnerability affects all Parse Server deployments that utilize the password reset feature.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.488.6.48npm install parse-server@8.6.48 -
>= 9.0.0, < 9.6.0-alpha.289.6.0-alpha.28npm install parse-server@9.6.0-alpha.28
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability other than upgrading to the patched version of Parse Server.
Conclusion
The identified vulnerability in Parse Server's password reset mechanism poses a significant risk by allowing attackers to exploit reset tokens. It is essential for developers using Parse Server to upgrade to the latest patched versions to ensure the security of their applications and protect user data.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows multiple concurrent requests to use the same password reset token, enabling an attacker to potentially change a user's password without their consent.
If your application uses Parse Server for password resets and is running a version prior to the patched releases (9.6.0-alpha.28 or 8.6.48), it is likely affected.
While there are no workarounds, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate the risk.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground.
The CVSS score for this vulnerability is 2.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
