EUVD-2026-12991
GHSA-r3xq-68wh-gwvh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Impact
The password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests within a short time window. An attacker who has intercepted a password reset token can race the legitimate user's password reset request, causing both requests to succeed. This may result in the legitimate user believing their password was changed successfully while the attacker's password takes effect instead.
All Parse Server deployments that use the password reset feature are affected.
Patches
The password reset token is now atomically validated and consumed as part of the password update operation. The database query that updates the password includes the reset token as a condition, ensuring that only one concurrent request can successfully consume the token. Subsequent requests using the same token will fail because the token has already been cleared.
Workarounds
There is no known workaround other than upgrading.
AnalysisAI
The password reset mechanism in Parse Server fails to enforce single-use guarantees on reset tokens, allowing attackers to exploit a race condition during concurrent password reset requests. An attacker who intercepts a password reset token can submit a password change request that races against the legitimate user's own reset attempt, potentially causing the attacker's new password to take effect while the user believes their own password was successfully changed. All Parse Server deployments using the password reset feature are affected, with patched versions available from the vendor (Parse Server versions 8.6.48 and later, and 9.6.0-alpha.28 and later).
Technical ContextAI
Parse Server is a Node.js backend framework (pkg:npm/parse-server) used for deploying parse-compatible backends. The vulnerability exists in the password reset token validation mechanism, which suffers from a Time-of-Check-Time-of-Use (TOCTOU) race condition classified under CWE-367 (Improper Synchronization). When a password reset token is generated, the backend fails to atomically validate and consume the token during the password update operation. Instead, the validation and consumption occur as separate database operations, allowing multiple concurrent requests to bypass the single-use guarantee. The patch implements atomic validation by including the reset token as a condition in the database query that updates the password, ensuring only one request can successfully consume the token. Subsequent requests using the same token fail because the token is immediately cleared upon successful consumption.
RemediationAI
Upgrade Parse Server immediately to version 8.6.48 or later, or to 9.6.0-alpha.28 or later if using the 9.x branch. The patches are available via GitHub pull requests 10216 and 10217 on the parse-community/parse-server repository (https://github.com/parse-community/parse-server). No workarounds exist other than upgrading, as stated by the vendor. Organizations unable to patch immediately should implement additional controls: enforce HTTPS-only password reset token transmission, implement rate limiting on password reset endpoints to increase attack complexity, and monitor password reset logs for concurrent requests with identical tokens. Consider restricting password reset functionality to internal networks only if feasible.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today