CVE-2026-30941: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30941 is a NoSQL injection vulnerability in Parse Server, an open-source Node.js backend platform, affecting the password reset and email verification resend endpoints. An unauthenticated attacker can inject MongoDB query operators via the unvalidated token field to extract password reset and email verification tokens from the database. Affected versions include all Parse Server releases prior to 8.6.14 (8.x branch) and versions 9.0.0 through 9.5.2-alpha.1 (9.x branch). The vulnerability was published on March 10, 2026, with patches released the same day. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, Parse Server Advisory).

The root cause is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic): the token parameter submitted to the password reset and email verification resend endpoints is passed directly to MongoDB queries without type validation, allowing an attacker to supply MongoDB query operators (e.g., $gt, $regex) instead of a plain string token. By crafting requests with operator-based payloads in the token field, an attacker can manipulate query logic to enumerate or extract valid tokens stored in the database. The attack is network-accessible, requires no authentication, no user interaction, and no special privileges — the only precondition is that the target Parse Server deployment uses MongoDB and has email verification or password reset functionality enabled. When emailVerifyTokenReuseIfValid is configured, the email verification token can be fully extracted and used to verify a user's email address without inbox access. The fix adds input type validation at the endpoint level to reject non-string token values (Parse Server Advisory, Github Advisory).

Successful exploitation allows an unauthenticated attacker to extract password reset and email verification tokens from the MongoDB database, enabling unauthorized account takeover without requiring access to the victim's email inbox. When emailVerifyTokenReuseIfValid is enabled, the attacker can fully extract and reuse the email verification token to verify a user's account, bypassing normal email-based confirmation flows. The primary impact is a high confidentiality loss of sensitive authentication tokens; integrity and availability of the system are not directly affected by this vulnerability (Github Advisory, Parse Server Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.059% (19th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported. The vulnerability was discovered and reported by security researcher 0xkakash1 and coordinated by mtrezza (Parse Server Advisory).

1. Reconnaissance: Identify internet-facing Parse Server deployments (e.g., via Shodan, Censys, or application fingerprinting) running versions prior to 8.6.14 or between 9.0.0 and 9.5.2-alpha.1, with email verification or password reset enabled.
2. Identify target endpoint: Locate the password reset (/1/requestPasswordReset) or email verification resend endpoint exposed by the Parse Server API.
3. Craft NoSQL injection payload: Instead of supplying a valid string token, craft a request body where the token field contains a MongoDB query operator object — for example, {"token": {"$gt": ""}} or {"token": {"$regex": ".*"}} — to match any token stored in the database.
4. Send the malicious request: Submit the crafted HTTP POST request to the target endpoint. The server passes the operator object directly to the MongoDB query without type validation, causing the query to match and return results for any stored token.
5. Extract tokens: Use iterative or regex-based operator payloads to enumerate and extract the actual token values character by character from the database response or error behavior.
6. Account takeover: Use the extracted password reset token to reset a target user's password, or (if emailVerifyTokenReuseIfValid is configured) use the extracted email verification token to verify a user's email address without inbox access, enabling unauthorized account access (Parse Server Advisory, Github Advisory).

• Network: Unusual HTTP POST requests to Parse Server password reset (/1/requestPasswordReset) or email verification resend endpoints where the token field contains JSON objects or MongoDB operator syntax (e.g., $gt, $regex, $ne) rather than a plain string value; high volume of repeated requests to these endpoints from a single IP address.
• Logs: Parse Server application logs showing repeated or failed token validation attempts; requests with non-string token field values in access logs; anomalous patterns of token-related API calls in short time windows.
• Application Behavior: Unexpected email verification completions or password reset flows succeeding without corresponding user-initiated email link clicks; accounts being verified or passwords reset without user-reported action.

Parse Server has released patches addressing this vulnerability: upgrade to version 8.6.14 or later for the 8.x branch, or 9.5.2-alpha.1 or later for the 9.x branch (Parse Server 8.6.14 Release, Parse Server 9.5.2-alpha.1 Release). There is no known configuration-based workaround; the advisory explicitly states no workaround exists (Parse Server Advisory). As a temporary risk-reduction measure for deployments that cannot immediately patch, consider disabling email verification and password reset functionality, monitoring application logs for suspicious token-field patterns, and ensuring MongoDB access controls are properly configured to limit query exposure.

The vulnerability was coordinated and published by Parse Server maintainer mtrezza, with the reporter credited as 0xkakash1 (Parse Server Advisory). The advisory was picked up by automated CVE tracking accounts on Bluesky and aggregated by VulDB and GitLab's advisory database shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database entries.