Parse Server MFA SMS OTP Race Condition Vulnerability (GHSA-jp44-7mqg-q9j9)

Vulnerability Summary: MFA SMS One-Time Password Accepted Twice Under Concurrent Login Vulnerability Overview Vulnerability Name: MFA SMS one-time password accepted twice under concurrent login Vulnerability Type: Race Condition CVSS Score: 2.1 / 10 (Low) Description: A race condition exists in the MFA SMS one-time password (OTP) login path, allowing two concurrent requests carrying the same OTP to successfully execute and receive valid session tokens. This undermines the single-use property of the OTP. Attack Conditions: The attacker must be able to control the victim's SMS OTP (e.g., via SIM swapping, network interception, or phishing relay) and issue requests faster than the legitimate login request. Affected Versions Affected Versions: >= 9.0.0, < 9.9.0-alpha.2 and < 8.6.76 Fixed Versions: 9.9.0-alpha.2 and 8.6.76 Remediation Patch Details: Optimistic locking has been generalized to cover the original field (strings, numbers, booleans). The lock is implemented via a helper that adds an equality predicate to check for changes in fields from the original value during clause updates. Concurrent writers now match the same single-use token against the condition and receive an response. Workarounds: - Disable SMS MFA and use TOTP (TOTP tokens are validated by time window and not stored as single-use). - Implement rate limiting on the endpoint to reduce the burst capacity of concurrent requests. References GitHub Security Advisory: GHSA-jp44-7mqg-q9j9 Fix Parse Server 9: #10448 Fix Parse Server 8: #10449

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server MFA SMS OTP Race Condition Vulnerability (GHSA-jp44-7mqg-q9j9)

More from this source