Executive brief
Parse Server is an open-source backend framework used to build and deploy applications. A security flaw in its multi-factor authentication (MFA) system allows an attacker to bypass the single-use restriction of SMS one-time passwords (OTPs) through a race condition. If an attacker already knows a user's password and intercepts their SMS code, they can log in simultaneously with the legitimate user, potentially maintaining unauthorized access to the account.
Technical details
A race condition exists in the MFA SMS OTP login path of Parse Server due to improper synchronization when updating authentication data. Specifically, the optimistic locking mechanism previously implemented only covered array-typed 'authData' fields; because SMS MFA stores the OTP as a string, the guard was bypassed. An attacker who has already obtained a victim's password and intercepted the SMS OTP (via SIM swap, phishing, etc.) can send concurrent /login requests to race the legitimate user. If successful, both requests receive valid session tokens. The fix generalizes the optimistic lock to cover primitive types (string, number, boolean) by adding equality predicates on the original values in the update WHERE clause.
Affected products
- Parse Platform Parse Server < 8.6.76, >= 9.0.0 < 9.9.0-alpha.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-04-26: patched