CVE-2026-43930

npm/parse-server CVE-2026-43930: low

parse-server: MFA SMS one-time password accepted twice under concurrent login

Action: Upgrade parse-server to 8.6.76 or later.

npm i parse-server@9.9.0-alpha.2

npm i parse-server@8.6.76

Affected

Fixed versions

Sources

• osv: GHSA-jpq4-7fmq-q5fj
• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
• https://nvd.nist.gov/vuln/detail/CVE-2026-43930
• https://github.com/parse-community/parse-server/pull/10448
• https://github.com/parse-community/parse-server/pull/10449
• https://github.com/parse-community/parse-server

CVE-2026-43930 · published 2026-05-05T20:30:44Z · modified 2026-05-14T12:26:29.359027637Z · JSON