Is CVE-2026-43930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43930 being exploited in the wild.

How severe is CVE-2026-43930?

Medium severity, with a CVSS score of 5.9, published 12 May 2026.

Which products and versions are affected?

parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.9.0-alpha.2.

Is there a fix for CVE-2026-43930?

Yes. parse-server (npm): upgrade to 9.9.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43930 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43930?

Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43930: Parse Platform Parse Server race condition in SMS MFA login

CVE-2026-43930 · Severity: medium · CVSS 5.9 · Published 2026-05-12

Parse Server is an open-source backend framework used to build and deploy applications. A security flaw in its multi-factor authentication (MFA) system allows an attacker to bypass the single-use restriction of SMS one-time passwords (OTPs) through a race condition. If an attacker already knows a user's password and intercepts their SMS code, they can log in simultaneously with the legitimate user, potentially maintaining unauthorized access to the account.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-43930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43930 being exploited in the wild.
How severe is CVE-2026-43930?: Medium severity, with a CVSS score of 5.9, published 12 May 2026.
Which products and versions are affected?: parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.9.0-alpha.2.
Is there a fix for CVE-2026-43930?: Yes. parse-server (npm): upgrade to 9.9.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43930 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43930?: Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-server (npm): upgrade to 9.9.0-alpha.2 or later
```
npm install parse-server@9.9.0-alpha.2
```

Technical details

A race condition exists in the MFA SMS OTP login path of Parse Server due to improper synchronization when updating authentication data. Specifically, the optimistic locking mechanism previously implemented only covered array-typed 'authData' fields; because SMS MFA stores the OTP as a string, the guard was bypassed. An attacker who has already obtained a victim's password and intercepted the SMS OTP (via SIM swap, phishing, etc.) can send concurrent /login requests to race the legitimate user. If successful, both requests receive valid session tokens. The fix generalizes the optimistic lock to cover primitive types (string, number, boolean) by adding equality predicates on the original values in the update WHERE clause.

Affected products

Parse Platform Parse Server < 8.6.76, >= 9.0.0 < 9.9.0-alpha.2

Identifiers

CVE-2026-43930
GHSA-jpq4-7fmq-q5fj

Timeline

2026-05-12: disclosed
2026-05-12: advisory
2026-04-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.