Junglewise Threat Intelligence

CVE-2026-33624: Parse Server MFA recovery code reuse via concurrent requests

CVE-2026-33624 · Severity: medium · CVSS 4 · Published 2026-03-24

Vendors: Parse Community.

Executive brief

Parse Server is a backend-as-a-service platform that manages user authentication and multi-factor authentication (MFA) for applications. An attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code multiple times by sending concurrent login requests, bypassing the intended single-use protection. This allows unauthorized account access even when MFA is enabled.

Technical details

This vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Parse Server's MFA recovery code validation logic. During login, the server checks if a recovery code is valid and single-use, then updates the auth data to mark it as consumed. Between these operations, an attacker can send concurrent requests using the same recovery code; if multiple requests pass the validity check before any update completes, all will succeed. The attack requires network access to the login endpoint, possession of the target user's password, and a valid recovery code—making it a high-privilege, high-complexity attack. The patch implements optimistic locking on auth data updates containing consumed tokens, causing concurrent requests to fail if another request has already modified the recovery array. Patches are available in Parse Server 8.6.60 and 9.6.0-alpha.54.

Affected products

  • Parse Community Parse Server < 8.6.60; >= 9.0.0, < 9.6.0-alpha.54

Timeline

  • 2026-03-24: disclosed: GHSA-2299-ghjr-6vjp published
  • 2026-03-22: patched: Fix merged in PR #10275 and #10276; patches released in versions 8.6.60 and 9.6.0-alpha.54

References