CVE-2026-33624: Parse Server MFA recovery code reuse via concurrent requests

CVE-2026-33624 · Severity: medium · CVSS 4 · Published 2026-03-24

Parse Server is a backend-as-a-service platform that manages user authentication and multi-factor authentication (MFA) for applications. An attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code multiple times by sending concurrent login requests, bypassing the intended single-use protection. This allows unauthorized account access even when MFA is enabled.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-33624 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33624 being exploited in the wild.
How severe is CVE-2026-33624?
Medium severity, with a CVSS score of 4, published 24 March 2026.
Which products and versions are affected?
Parse Community Parse Server < 8.6.60; >= 9.0.0, < 9.6.0-alpha.54.
Is there a fix for CVE-2026-33624?
A patch was published on 2026-03-22: Fix merged in PR #10275 and #10276; patches released in versions 8.6.60 and 9.6.0-alpha.54 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33624 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33624?
Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Parse Server's MFA recovery code validation logic. During login, the server checks if a recovery code is valid and single-use, then updates the auth data to mark it as consumed. Between these operations, an attacker can send concurrent requests using the same recovery code; if multiple requests pass the validity check before any update completes, all will succeed. The attack requires network access to the login endpoint, possession of the target user's password, and a valid recovery code—making it a high-privilege, high-complexity attack. The patch implements optimistic locking on auth data updates containing consumed tokens, causing concurrent requests to fail if another request has already modified the recovery array. Patches are available in Parse Server 8.6.60 and 9.6.0-alpha.54.

Affected products

  • Parse Community Parse Server < 8.6.60; >= 9.0.0, < 9.6.0-alpha.54

Identifiers

  • CVE-2026-33624
  • GHSA-2299-ghjr-6vjp

Timeline

  • 2026-03-24: disclosed: GHSA-2299-ghjr-6vjp published
  • 2026-03-22: patched: Fix merged in PR #10275 and #10276; patches released in versions 8.6.60 and 9.6.0-alpha.54

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.