PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43930 parse-community CVE debrief

A race condition in Parse Server's MFA SMS OTP login path allows two concurrent /login requests with the same OTP to both succeed, violating the single-use property of one-time passwords. The vulnerability exists in versions prior to 8.6.76 and 9.9.0-alpha.2. Exploitation requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g., via SIM swap, network mirror, or phishing relay), then race the legitimate login request. This narrow attack surface, combined with high attack complexity and required privileges, results in a LOW severity rating. The issue was published on 2026-05-12 and last modified on 2026-05-26. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
parse-community
Product
parse-server
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-26
Advisory published
2026-05-12
Advisory updated
2026-05-26

Who should care

Organizations running Parse Server versions prior to 8.6.76 or 9.9.0-alpha.2 with SMS-based MFA enabled. Security teams monitoring for authentication bypass techniques. Infrastructure operators with Parse Server deployments handling sensitive user sessions.

Technical summary

The vulnerability is a race condition (CWE-362) in the multi-factor authentication SMS one-time password login flow. When two /login requests containing the same OTP are submitted concurrently, both requests can succeed and generate valid session tokens. This breaks the fundamental single-use guarantee of OTPs. The root cause appears to be insufficient synchronization or validation during the OTP consumption check. The fix in versions 8.6.76 and 9.9.0-alpha.2 implements proper atomicity in the OTP validation and consumption process.

Defensive priority

LOW

Recommended defensive actions

  • Upgrade Parse Server to version 8.6.76 or later, or 9.9.0-alpha.2 or later for the 9.x branch
  • Review authentication logs for concurrent /login requests with identical OTP values that both succeeded prior to patching
  • Consider implementing additional rate limiting or concurrency controls on the /login endpoint as defense in depth
  • Evaluate MFA methods beyond SMS OTP where practical, given inherent risks of SMS interception
  • Monitor for indicators of OTP interception such as unexpected login locations or rapid successive authentication attempts

Evidence notes

The vulnerability description and affected version ranges are derived from the official CVE record and NVD entry. The race condition affects the MFA SMS OTP login path specifically. Fix versions 8.6.76 and 9.9.0-alpha.2 are confirmed by vendor security advisory. CVSS 4.0 vector indicates network attack vector with high attack complexity and high privileges required.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43930 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43930

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43930 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43930

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.