Sign in
Deutsch English Español Polski
Low

parse-server: MFA SMS one-time password accepted twice under concurrent login

  • Disclosed: 05.05.2026
  • Updated: 11.10.2026 10:22

Impact

A race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow.

This advisory is the same class of incomplete fix as GHSA-2299-ghjr-6vjp (TOTP recovery codes) and GHSA-w73w-g5xw-rwhf (MFA recovery in authData-only login). Those previous fixes added optimistic locking only for array-typed authData fields; SMS MFA stores the OTP as a string, so the guard skipped it.

Patches

The optimistic lock has been generalized to cover primitive (string, number, boolean) and array authData fields. The lock is implemented as a shared helper applyAuthDataOptimisticLock that adds equality predicates on the original values of changed fields to the update WHERE clause. Concurrent writers racing the same single-use token now miss the WHERE condition and surface as Invalid auth data.

Workarounds

  • Disable SMS MFA and use TOTP instead (TOTP tokens are time-window validated, not stored single-use).
  • Place a rate limiter on the /login endpoint to reduce concurrent-request burst capacity.

Resources

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package parse-server >= 9.0.0, < 9.9.0-alpha.2, < 8.6.76 9.9.0-alpha.2, 8.6.76

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-362
Platform
npm
Package
parse-server
Disclosed
05.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-jpq4-7fmq-q5fj - CC BY 4.0

Vulnerability history: parse-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (116) in the archive
Total entries
116
First → latest
06.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 17
  • High 49
  • Medium 40
  • Low 10

Disclosures per year

Severity:
  1. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    High CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  2. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    High CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  3. parse-server: MFA SMS one-time password accepted twice under concurrent login this entry
    Low CVE-2026-43930 >= 9.0.0, < 9.9.0-alpha.2, < 8.6.76 9.9.0-alpha.2, 8.6.76
  4. Parser Server's streaming file download bypasses afterFind file trigger authorization
    High CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  5. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    High CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  6. parse-server has cloud function validator bypass via prototype chain traversal
    Critical CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  7. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    High CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  8. Parse Server exposes auth data via verify password endpoint
    High CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  9. Parse Server exposes auth data via /users/me endpoint
    High CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  10. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    High CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  11. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    High CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  12. Parse Server LiveQuery subscription query depth bypass
    High · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  13. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    High · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  14. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    High · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  15. Parse Server has an auth provider validation bypass on login via partial authData
    High · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  16. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    High CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  17. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    High CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  18. Parse Server crash via deeply nested query condition operators
    High CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  19. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    High CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  20. Parse Server: Account takeover via operator injection in authentication data identifier
    Critical CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  21. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Critical CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  22. Parse Server's MFA recovery codes not consumed after use
    High CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  23. Parse Server has a protected fields bypass via dot-notation in query and sort
    High CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  24. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Critical CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  25. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Critical CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  26. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    High CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  27. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    High CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  28. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Critical · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  29. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Critical CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  30. Parse Server has a protected fields bypass via logical query operators
    High CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  31. Parse Server missing audience validation in Keycloak authentication adapter
    High CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  32. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    High CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  33. Parse Server has a bypass of class-level permissions in LiveQuery
    High CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  34. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    High CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  35. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    High CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  36. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Critical CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  37. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    High CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  38. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    High CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  39. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Critical CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  40. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    High CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
  41. Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
    High CVE-2026-29182 >= 9.0.0, < 9.4.1-alpha.3, < 8.6.4 9.4.1-alpha.3, 8.6.4
  42. Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
    Critical CVE-2026-27804 >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3 9.3.1-alpha.4, 8.6.3
  43. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
    High CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  44. Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
    High · 7.5 CVE-2025-64430 >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0-alpha.2 7.5.4, 8.4.0-alpha.2
  45. Parse Server's custom object ID allows to acquire role privileges
    High · 8.1 CVE-2024-47183 < 6.5.9, >= 7.0.0, < 7.3.0 6.5.9, 7.3.0
  46. ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
    Critical · 9.8 CVE-2024-39309 < 6.5.7, >= 7.0.0, < 7.1.0 6.5.7, 7.1.0
  47. Server crashes on invalid Cloud Function or Cloud Job name
    Critical · 9.0 CVE-2024-29027 < 6.5.5, >= 7.0.0-alpha.1, < 7.0.0-alpha.29 6.5.5, 7.0.0-alpha.29
  48. ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
    Critical · 10.0 CVE-2024-27298 < 6.5.0, >= 7.0.0-alpha.1, < 7.0.0-alpha.20 6.5.0, 7.0.0-alpha.20
  49. Parse Server may crash when uploading file without extension
    High · 7.5 CVE-2023-46119 >= 1.0.0, < 5.5.6, >= 6.0.0, < 6.3.1 5.5.6, 6.3.1
  50. Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
    High · 7.5 CVE-2023-41058 >= 1.0.0, < 5.5.5, >= 6.0.0, < 6.2.2 5.5.5, 6.2.2
  51. Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
    Critical · 9.8 CVE-2023-36475 < 5.5.2, >= 6.0.0, < 6.2.1 5.5.2, 6.2.1
  52. Parse Server option `masterKeyIps` vulnerability to IP spoofing
    High · 8.7 CVE-2023-22474 < 5.4.1 5.4.1
  53. Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
    High · 7.2 CVE-2022-41879 < 4.10.20, >= 5.0.0, < 5.3.3 4.10.20, 5.3.3
  54. Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
    High · 7.2 CVE-2022-41878 < 4.10.19, >= 5.0.0, < 5.3.2 4.10.19, 5.3.2
  55. Remote code execution via MongoDB BSON parser through prototype pollution
    Critical · 9.8 CVE-2022-39396 < 4.10.18, >= 5.0.0, < 5.3.1 4.10.18, 5.3.1
  56. parse-server crashes when receiving file download request with invalid byte range
    High · 7.5 CVE-2022-39313 < 4.10.17, >= 5.0.0, < 5.2.8 4.10.17, 5.2.8
  57. Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
    High · 8.6 CVE-2022-36079 < 4.10.14, >= 5.0.0, < 5.2.5 4.10.14, 5.2.5
  58. Protected fields exposed via LiveQuery
    High · 8.2 CVE-2022-31112 < 4.10.13, >= 5.0.0, < 5.2.4 4.10.13, 5.2.4
  59. Invalid file request can crash server
    High · 7.5 CVE-2022-31089 < 4.10.12, >= 5.0.0, < 5.2.3 4.10.12, 5.2.3
  60. Authentication bypass vulnerability in Apple Game Center auth adapter
    High · 8.6 CVE-2022-31083 < 4.10.11, >= 5.0.0, < 5.2.2 4.10.11, 5.2.2
  61. Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
    High · 7.5 CVE-2022-24901 < 4.10.10, >= 5.0.0, < 5.2.1 4.10.10, 5.2.1
  62. Command injection in Parse Server through prototype pollution
    Critical · 10.0 CVE-2022-24760 < 4.10.7 4.10.7
  63. LiveQuery publishes user session tokens in parse-server
    High · 7.5 CVE-2021-41109 < 4.10.4 4.10.4
  64. Incorrect version tags linked to external repository
    Critical CVE-2021-47986 >= 4.0.0, < 4.5.2, >= 4.6.0, < 4.10.0 4.5.2, 4.10.0
  65. Parse Server crashes with query parameter
    High · 7.5 CVE-2021-39187 < 4.10.3 4.10.3
  66. Information disclosure in parse-server
    High · 7.7 CVE-2020-5251 < 4.1.0 4.1.0
  67. Parse Server before v3.4.1 vulnerable to Denial of Service
    High · 7.5 CVE-2019-1020012 < 3.4.1 3.4.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.