CVE-2026-32943: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32943 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Parse Server's password reset mechanism, allowing password reset tokens to be consumed by multiple concurrent requests within a short time window. It affects all Parse Server deployments using the password reset feature: versions prior to 8.6.48 (8.x branch) and versions 9.0.0 through prior to 9.6.0-alpha.28 (9.x branch), running on Node.js. The vulnerability was disclosed on March 18, 2026, with patches released on March 16, 2026. It carries a CVSS v3.1 base score of 3.1 (Low) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition): the password reset flow validates a token and then updates the password in two separate, non-atomic operations, leaving a window during which the same token remains valid. An attacker who has intercepted a legitimate password reset token can send concurrent HTTP requests to the password reset endpoint, racing the legitimate user's request so that both succeed — the attacker's chosen password ultimately takes effect. The fix, implemented in src/Controllers/UserController.js, makes token validation and consumption atomic by including the _perishable_token as a condition in the database update query, so only one concurrent request can succeed and subsequent requests using the same token fail because the token has already been cleared (GitHub Advisory, PR #10216).

Successful exploitation allows an attacker who has intercepted a password reset token to take over the targeted user account by setting their own password, while the legitimate user believes their password change succeeded. The primary impact is an integrity compromise of user account credentials, with no direct confidentiality or availability impact. All Parse Server deployments that use the password reset feature are affected, and account compromise could enable further unauthorized access to application data and resources depending on the privileges of the targeted account (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires the attacker to first intercept a valid password reset token (e.g., via network interception or phishing), making opportunistic exploitation difficult. The EPSS score is approximately 0.036%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Token Interception: Obtain a valid password reset token for a target user account by intercepting the reset email (e.g., via a man-in-the-middle attack, email account compromise, or phishing).
2. Prepare Concurrent Requests: Craft two or more simultaneous HTTP POST requests to the Parse Server password reset endpoint (e.g., /1/requestPasswordReset or the configured reset URL), each using the intercepted token but specifying different new passwords — one the attacker controls, one the legitimate user's intended password.
3. Race the Legitimate User: Time the concurrent requests to be sent within the same short time window as the legitimate user's reset attempt, exploiting the non-atomic token validation window.
4. Account Takeover: If the attacker's request is processed last (or wins the race), the attacker's chosen password is set on the account. The legitimate user sees a success message but the attacker's password is now in effect, granting the attacker full access to the account (GitHub Advisory, PR #10216).

• Network: Multiple near-simultaneous HTTP POST requests to the Parse Server password reset endpoint from different source IPs or user agents within milliseconds of each other, using the same reset token.
• Logs: Parse Server access logs showing two or more successful password reset responses (HTTP 200) for the same token within a very short time window; subsequent login failures by the legitimate user immediately after a password reset.
• Application Behavior: User reports of being locked out of their account shortly after initiating a password reset, despite receiving a success confirmation.

Upgrade Parse Server immediately to version 8.6.48 (for the 8.x LTS branch) or 9.6.0-alpha.28 or later (for the 9.x branch); the stable 9.6.0 release also includes this fix. There is no known workaround other than upgrading — the vulnerability is inherent to the non-atomic token handling in older versions. As an additional defensive measure, review access logs for suspicious concurrent password reset attempts and consider implementing multi-factor authentication for sensitive accounts (GitHub Advisory, PR #10216, PR #10217).