CVE-2026-32943: Parse Server Race Condition Vulnerability

CVE-2026-32943 Overview

CVE-2026-32943 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure running Node.js. The password reset mechanism in affected versions does not enforce single-use guarantees for reset tokens, allowing multiple concurrent requests to consume the same token within a short time window.

Critical Impact

An attacker who intercepts a password reset token can race the legitimate user's password reset request, potentially causing the attacker's password to take effect while the legitimate user believes their password was changed successfully.

Affected Products

• Parse Server versions prior to 8.6.48
• Parse Server versions 9.6.0-alpha1 through 9.6.0-alpha27
• All Parse Server deployments utilizing the password reset feature

Discovery Timeline

• 2026-03-18 - CVE-2026-32943 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32943

Vulnerability Analysis

This vulnerability is classified under CWE-367 (Time-of-Check Time-of-Use Race Condition). The core issue lies in the non-atomic handling of password reset tokens during the password update operation. When a user initiates a password reset, Parse Server generates a token that should be valid for a single use only. However, the token validation and consumption were implemented as separate operations, creating a window where multiple concurrent requests could successfully validate and use the same token.

The attack requires network access and depends on the attacker's ability to intercept a valid password reset token, typically through methods such as email interception, man-in-the-middle attacks, or access to email logs. Once a token is obtained, the attacker can submit a password reset request simultaneously with the legitimate user.

Root Cause

The root cause stems from a lack of atomicity in the password reset token validation process. In vulnerable versions, the application first verifies that the reset token is valid, then updates the password and clears the token in subsequent operations. This two-step process creates a race window where multiple requests can pass the validation check before any single request clears the token.

Attack Vector

The attack exploits the network-accessible password reset endpoint. An attacker who has obtained a valid reset token through interception can craft a password reset request with their chosen password. By timing this request to coincide with the legitimate user's password reset attempt, both requests may pass token validation. Due to the non-deterministic nature of concurrent request processing, the attacker's password may be the one that ultimately persists in the database, while the legitimate user receives a success response.

The vulnerability mechanism operates as follows: when concurrent password reset requests arrive, each request independently validates the token, finds it valid, and proceeds to update the password. Since the token is not atomically consumed during validation, multiple requests can succeed. The final password stored depends on which database write completes last.

Detection Methods for CVE-2026-32943

Indicators of Compromise

• Multiple password reset completion requests for the same user account within milliseconds
• Password reset success logs followed by immediate authentication failures for the legitimate user
• Concurrent HTTP POST requests to the password reset endpoint with identical token values
• User reports of password reset completing successfully but new password not working

Detection Strategies

• Implement request logging that correlates password reset tokens with timestamps to identify concurrent token usage attempts
• Monitor for rapid successive password reset completions (within 1-2 seconds) targeting the same user account
• Configure web application firewall rules to flag multiple password reset requests with identical tokens
• Analyze database query logs for concurrent UPDATE operations on user password fields

Monitoring Recommendations

• Enable detailed logging on the Parse Server password reset endpoints (/requestPasswordReset and /resetPassword)
• Set up alerts for anomalous patterns in password reset activity, particularly multiple completions per token
• Monitor user authentication failure rates following password reset operations for potential attack indicators
• Review Parse Server audit logs regularly for patterns consistent with race condition exploitation

How to Mitigate CVE-2026-32943

Immediate Actions Required

• Upgrade Parse Server to version 8.6.48 or later for the stable branch
• Upgrade to version 9.6.0-alpha.28 or later for the alpha branch
• Review recent password reset logs for any signs of exploitation
• Consider notifying users who recently completed password resets to verify their account access

Patch Information

The fix is available in Parse Server versions 9.6.0-alpha.28 and 8.6.48. The remediation implements atomic validation and consumption of password reset tokens by including the reset token as a condition in the database query that updates the password. This ensures that only one concurrent request can successfully consume the token, as subsequent requests will fail because the token has already been cleared.

For technical details on the fix implementation, refer to GitHub Pull Request #10216 and GitHub Pull Request #10217. The official security advisory is available at GitHub Security Advisory GHSA-r3xq-68wh-gwvh.

Workarounds

• There is no known workaround other than upgrading to a patched version
• Consider temporarily disabling the password reset feature if immediate upgrading is not possible and the risk is deemed unacceptable
• Implement rate limiting on password reset endpoints to reduce the attack window, though this does not fully mitigate the vulnerability
• Deploy additional monitoring to detect potential exploitation attempts until the upgrade is completed

# Upgrade Parse Server to patched version
npm update parse-server@8.6.48

# Or for alpha branch users
npm update parse-server@9.6.0-alpha.28

# Verify installed version
npm list parse-server