Parse Server, prior to version 8.6.76 and 9.9.0-alpha.2, has a race condition in the MFA SMS one‑time password (OTP) login flow that allows two concurrent /login requests carrying the same OTP to both succeed, granting two valid session tokens and breaking the OTP’s single‑use guarantee. This flaw can be exploited by an attacker who already has the victim’s password and can intercept an active SMS OTP, such as through a SIM‑swap, network mirror, or phishing relay. The resulting impact is the ability to create multiple authenticated sessions from a single OTP.

The affected product is Parse Server, an open‑source backend by parse-community. All releases before 8.6.76 and before 9.9.0-alpha.2 are vulnerable.

The CVSS score of 2.1 reflects low severity, and the EPSS score is not available, indicating no documented exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to already possess the victim’s password and an intercepted OTP, and the race condition demands precise timing of two concurrent login attempts. Consequently, the likelihood of successful exploitation is low, though the potential impact would be the duplication of session tokens for a single OTP.