Parse Server: MFA SMS one-time password accepted twice under concurrent login

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-43930 · Microsoft / collected KEV context

EUVD-2026-29475

GHSA-jpq4-7fmq-q5fj

BIT-parse-2026-43930

cve-program · CVE-2026-43930

• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
• https://github.com/parse-community/parse-server/pull/10448
• https://github.com/parse-community/parse-server/pull/10449

euvd · EUVD-2026-29475

• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
• https://github.com/parse-community/parse-server/pull/10448
• https://github.com/parse-community/parse-server/pull/10449

nvd · CVE-2026-43930

• https://github.com/parse-community/parse-server/pull/10448
• https://github.com/parse-community/parse-server/pull/10449
• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj

osv · GHSA-jpq4-7fmq-q5fj

• https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj
• https://nvd.nist.gov/vuln/detail/CVE-2026-43930
• https://github.com/parse-community/parse-server/pull/10448
• https://github.com/parse-community/parse-server/pull/10449
• https://github.com/parse-community/parse-server

No related operational record is retained in the current change model.