Parse Server’s password reset mechanism did not enforce single-use guarantees for reset tokens in versions prior to 9.6.0-alpha.28 and 8.6.48. When a user requests a reset, the generated token can be consumed by multiple concurrent requests within a short window. An attacker who has obtained or intercepted the token can race the legitimate reset request, causing both to succeed. The user believes their password changed, while the attacker’s password takes effect, resulting in an account takeover. This weakness is identified as CWE‑367.

All deployments of parse-community:parse-server that use the password reset feature and run a version older than 9.6.0-alpha.28 or 8.6.48 are affected. The vulnerability affects all Parse Server releases prior to these version milestones, regardless of minor or patch levels.

The CVSS score is 2.3, indicating low impact. EPSS is below 1% and the flaw is not listed in the CISA KEV catalog. While the risk is low, exploitation is possible over the network by an attacker who can observe or inject the reset token. The vulnerability can be exploited by sending a concurrent reset request before the valid token is invalidated, which is a race condition and requires proximity to the token. No additional conditions or privilege are needed beyond the ability to use the password reset endpoint.