# CVE-2026-43930: Parse Platform Parse Server race condition in SMS MFA login

Source: https://junglewise.ai/threats/cve-2026-43930-parse-platform-parse-server-race-condition-in-sms-mfa-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-43930 · Severity: medium · CVSS 5.9 · Published 2026-05-12

Parse Server is an open-source backend framework used to build and deploy applications. A security flaw in its multi-factor authentication (MFA) system allows an attacker to bypass the single-use restriction of SMS one-time passwords (OTPs) through a race condition. If an attacker already knows a user's password and intercepts their SMS code, they can log in simultaneously with the legitimate user, potentially maintaining unauthorized access to the account.

Technologies: [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-43930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43930 being exploited in the wild.

**How severe is CVE-2026-43930?** Medium severity, with a CVSS score of 5.9, published 12 May 2026.

**Which products and versions are affected?** parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.9.0-alpha.2.

**Is there a fix for CVE-2026-43930?** Yes. parse-server (npm): upgrade to 9.9.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43930 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43930?** Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- parse-server (npm): upgrade to 9.9.0-alpha.2 or later

  ```sh
  npm install parse-server@9.9.0-alpha.2
  ```


## Technical details

A race condition exists in the MFA SMS OTP login path of Parse Server due to improper synchronization when updating authentication data. Specifically, the optimistic locking mechanism previously implemented only covered array-typed 'authData' fields; because SMS MFA stores the OTP as a string, the guard was bypassed. An attacker who has already obtained a victim's password and intercepted the SMS OTP (via SIM swap, phishing, etc.) can send concurrent /login requests to race the legitimate user. If successful, both requests receive valid session tokens. The fix generalizes the optimistic lock to cover primitive types (string, number, boolean) by adding equality predicates on the original values in the update WHERE clause.

## Affected products

- Parse Platform Parse Server < 8.6.76, >= 9.0.0 < 9.9.0-alpha.2

## Identifiers

- CVE-2026-43930
- GHSA-jpq4-7fmq-q5fj

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-04-26: patched

## References

- [https://github.com/parse-community/parse-server/pull/10448](https://github.com/parse-community/parse-server/pull/10448)
- [https://github.com/parse-community/parse-server/pull/10449](https://github.com/parse-community/parse-server/pull/10449)
- [https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj](https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj)

## Related threats

- [Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist](https://junglewise.ai/threats/duplicate-advisory-parse-server-vulnerable-to-stored-xss-via-malformed-00d8867c)
- [Parse Server stored XSS via malformed Content-Type bypass](https://junglewise.ai/threats/cve-2026-61448-parse-server-stored-xss-via-malformed-content-type-bypass)
- [Parse Server information disclosure in LiveQuery ACL transitions](https://junglewise.ai/threats/cve-2026-57481-parse-server-information-disclosure-in-livequery-acl-transitions)
- [Parse Community Parse Server denial of service via nested query operators](https://junglewise.ai/threats/cve-2026-57480-parse-community-parse-server-denial-of-service-via-nested-query)
- [Parse Server stored XSS via file upload extension bypass](https://junglewise.ai/threats/cve-2026-55778-parse-server-stored-xss-via-file-upload-extension-bypass)