Executive brief
Parse Server is a backend framework that manages user authentication and data for applications. When users enable multi-factor authentication, the system generates recovery codes as a backup authentication method. However, these recovery codes are not invalidated after use, allowing an attacker who obtains a single recovery code to repeatedly log in as the affected user indefinitely. This undermines the security of MFA-protected accounts and could lead to unauthorized account access.
Technical details
This vulnerability affects Parse Server's TOTP-based multi-factor authentication implementation. When MFA is enabled, the server generates two single-use recovery codes that should be consumed (removed) after a successful authentication. However, due to missing validation logic in the recovery code handling, these codes are never invalidated from the stored recovery code list, allowing unlimited reuse. The vulnerability requires network access to the authentication endpoint but does not require elevated privileges or user interaction. An attacker with knowledge of a valid recovery code can conduct repeated authentication attempts to compromise any MFA-protected account. The fix ensures that recovery codes are removed from the user's stored list immediately after successful use. Patches are available in Parse Server 8.6.33 and 9.6.0-alpha.7.
Affected products
- Parse Community Parse Server All versions before 8.6.33 and 9.0.0-alpha.1 before 9.6.0-alpha.7
Timeline
- 2026-03-11: disclosed: Advisory published as GHSA-4hf6-3x24-c9m8
- 2026-03-10: patched: Parse Server 8.6.33 released with fix
- 2026-03-10: patched: Parse Server 9.6.0-alpha.7 released with fix