Executive brief
Parse Server is a popular backend-as-a-service framework used to power mobile and web applications. The password reset feature contains a race condition that allows an attacker to reset a user's password by sending concurrent requests with an intercepted reset token. An attacker could hijack user accounts by resetting their password faster than the legitimate user, potentially gaining unauthorized access to customer data and accounts.
Technical details
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the password reset token validation logic (CWE-367). Reset tokens are not atomically validated and consumed; instead, the database query that checks token validity is separate from the query that clears it. An unauthenticated attacker with network access can send multiple concurrent password reset requests using the same intercepted token within a narrow time window. Due to the lack of atomic transaction handling, multiple requests may succeed before any single request invalidates the token. The fix implements atomic validation by including the reset token as a condition in the password update query itself, ensuring only one request succeeds. Parse Server versions 0–8.6.47 and 9.0.0–9.6.0-alpha.27 are affected; patches are available in 8.6.48 and 9.6.0-alpha.28.
Affected products
- Parse Community Parse Server 0–8.6.47, 9.0.0–9.6.0-alpha.27
Timeline
- 2026-03-17: disclosed: GHSA-r3xq-68wh-gwvh published
- 2026-03: patched: Patches released in Parse Server 8.6.48 and 9.6.0-alpha.28