CVE-2026-43930

{
  "id": "CVE-2026-43930",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T14:17:08.217",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive valid session tokens, breaking the single-use property of the OTP. The vulnerability requires the attacker to already possess the victim's password and intercept the active SMS OTP (e.g. via SIM swap, network mirror, or phishing relay) and to race the legitimate login request, so the practical attack surface is narrow. This vulnerability is fixed in 8.6.76 and 9.9.0-alpha.2."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de código abierto que puede desplegarse en cualquier infraestructura que pueda ejecutar Node.js. Antes de 8.6.76 y 9.9.0-alpha.2, una condición de carrera en la ruta de inicio de sesión de contraseña de un solo uso (OTP) de MFA SMS permite que dos solicitudes /login concurrentes que llevan la misma OTP tengan éxito y ambas reciban tokens de sesión válidos, rompiendo la propiedad de un solo uso de la OTP. La vulnerabilidad requiere que el atacante ya posea la contraseña de la víctima e intercepte la OTP SMS activa (por ejemplo, mediante intercambio de SIM, espejo de red o retransmisión de phishing) y compita con la solicitud de inicio de sesión legítima, por lo que la superficie de ataque práctica es estrecha. Esta vulnerabilidad está corregida en 8.6.76 y 9.9.0-alpha.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "versions": [
            {
              "version": ">= 9.0.0, < 9.9.0-alpha.2",
              "status": "affected"
            },
            {
              "version": "< 8.6.76",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:27:09.122314Z",
          "id": "CVE-2026-43930",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "8.6.76",
              "matchCriteriaId": "7AD300D9-387D-4D21-AAA6-E61721B6D5DD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "9.0.0",
              "versionEndExcluding": "9.9.0",
              "matchCriteriaId": "835039DB-1399-4A7B-A9E2-9894D49320E2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.9.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "F18BCE70-4AAF-4C8B-826D-4B9733BC4CD6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/pull/10448",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10449",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}