CVE-2026-31875: Parse Server MFA recovery codes not consumed after use
Impact
When multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as a fallback when the user cannot provide a TOTP token. However, recovery codes are not consumed after use, allowing the same recovery code to be used an unlimited number of times. This defeats the single-use design of recovery codes and weakens the security of MFA-protected accounts.
An attacker who obtains a single recovery code can repeatedly authenticate as the affected user without the code ever being invalidated.
Patches
The fix ensures that each recovery code is removed from the stored recovery code list after a successful login.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-4hf6-3x24-c9m8 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.7 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.33
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as a fallback when the user cannot provide a TOTP token. However, recovery codes are not consumed after use, allowing the same recovery code to be used an unlimited number of times. This defeats the single-use design of recovery codes and weakens the security of MFA-protected accounts. An attacker who obtains a single recovery code can repeatedly authenticate as the affected user without the code ever being invalidated. This vulnerability is fixed in 9.6.0-alpha.7 and 8.6.33.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31875?
CVE-2026-31875 is classified as a high severity vulnerability due to its potential to allow unauthorized access through reusable recovery codes.
How do I fix CVE-2026-31875?
To fix CVE-2026-31875, upgrade Parse Server to version 8.6.33 or 9.6.0-alpha.7 to ensure proper handling of recovery codes.
What systems are affected by CVE-2026-31875?
CVE-2026-31875 impacts Parse Server versions prior to 8.6.33 and versions from 9.0.0-alpha.1 up to, but not including, 9.6.0-alpha.7.
What is the risk of not addressing CVE-2026-31875?
Failure to address CVE-2026-31875 may result in unauthorized access to user accounts through the exploitation of non-consumed recovery codes.
Are there workarounds for CVE-2026-31875?
There are no recommended workarounds for CVE-2026-31875; upgrading to the patched versions is the only solution.