Parse Server has a password reset token single-use bypass via concurrent requests
Impact
The password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests within a short time window. An attacker who has intercepted a password reset token can race the legitimate user's password reset request, causing both requests to succeed. This may result in the legitimate user believing their password was changed successfully while the attacker's password takes effect instead.
All Parse Server deployments that use the password reset feature are affected.
Patches
The password reset token is now atomically validated and consumed as part of the password update operation. The database query that updates the password includes the reset token as a condition, ensuring that only one concurrent request can successfully consume the token. Subsequent requests using the same token will fail because the token has already been cleared.
Workarounds
There is no known workaround other than upgrading.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | parse-server | >= 9.0.0, < 9.6.0-alpha.28, < 8.6.48 | 9.6.0-alpha.28, 8.6.48 |
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-r3xq-68wh-gwvh
- https://nvd.nist.gov/vuln/detail/CVE-2026-32943
- https://github.com/parse-community/parse-server/pull/10216
- https://github.com/parse-community/parse-server/pull/10217
- https://github.com/parse-community/parse-server
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-367- Platform
- npm
- Package
parse-server- Disclosed
- 17.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r3xq-68wh-gwvh - CC BY 4.0
Vulnerability history: parse-server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 116
- First → latest
- 06.2019 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 17
- High 49
- Medium 40
- Low 10
Disclosures per year
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
Parse Server has a password reset token single-use bypass via concurrent requests this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.