CVE-2026-33624: Parse Server: MFA recovery code single-use bypass via concurrent requests

Published Mar 24, 2026
·
Updated

Impact

An attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds.

Patches

The login handler now uses optimistic locking when updating auth data that contains consumed single-use tokens. If a concurrent request has already modified the recovery array, the update fails and the login is rejected.

Workarounds

There are no known workarounds.

Other sources

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.

— MITRE

Affected Software

58 affected componentsFixes available
npm/parse-server<8.6.60, <9.6.0-alpha.54
npm/parse-server<8.6.60
8.6.60
npm/parse-server>=9.0.0<9.6.0-alpha.54
9.6.0-alpha.54
parseplatform Parse-server Node.js<8.6.60
parseplatform Parse-server Node.js>=9.0.0<9.6.0
parseplatform Parse-server Node.js=9.6.0-alpha1
parseplatform Parse-server Node.js=9.6.0-alpha10
parseplatform Parse-server Node.js=9.6.0-alpha11
parseplatform Parse-server Node.js=9.6.0-alpha12
parseplatform Parse-server Node.js=9.6.0-alpha13
parseplatform Parse-server Node.js=9.6.0-alpha14
parseplatform Parse-server Node.js=9.6.0-alpha15
parseplatform Parse-server Node.js=9.6.0-alpha16
parseplatform Parse-server Node.js=9.6.0-alpha17
parseplatform Parse-server Node.js=9.6.0-alpha18
parseplatform Parse-server Node.js=9.6.0-alpha19
parseplatform Parse-server Node.js=9.6.0-alpha2
parseplatform Parse-server Node.js=9.6.0-alpha20
parseplatform Parse-server Node.js=9.6.0-alpha21
parseplatform Parse-server Node.js=9.6.0-alpha22
parseplatform Parse-server Node.js=9.6.0-alpha23
parseplatform Parse-server Node.js=9.6.0-alpha24
parseplatform Parse-server Node.js=9.6.0-alpha25
parseplatform Parse-server Node.js=9.6.0-alpha26
parseplatform Parse-server Node.js=9.6.0-alpha27
parseplatform Parse-server Node.js=9.6.0-alpha28
parseplatform Parse-server Node.js=9.6.0-alpha29
parseplatform Parse-server Node.js=9.6.0-alpha3
parseplatform Parse-server Node.js=9.6.0-alpha30
parseplatform Parse-server Node.js=9.6.0-alpha31
parseplatform Parse-server Node.js=9.6.0-alpha32
parseplatform Parse-server Node.js=9.6.0-alpha33
parseplatform Parse-server Node.js=9.6.0-alpha34
parseplatform Parse-server Node.js=9.6.0-alpha35
parseplatform Parse-server Node.js=9.6.0-alpha36
parseplatform Parse-server Node.js=9.6.0-alpha37
parseplatform Parse-server Node.js=9.6.0-alpha38
parseplatform Parse-server Node.js=9.6.0-alpha39
parseplatform Parse-server Node.js=9.6.0-alpha4
parseplatform Parse-server Node.js=9.6.0-alpha40
parseplatform Parse-server Node.js=9.6.0-alpha41
parseplatform Parse-server Node.js=9.6.0-alpha42
parseplatform Parse-server Node.js=9.6.0-alpha43
parseplatform Parse-server Node.js=9.6.0-alpha44
parseplatform Parse-server Node.js=9.6.0-alpha45
parseplatform Parse-server Node.js=9.6.0-alpha46
parseplatform Parse-server Node.js=9.6.0-alpha47
parseplatform Parse-server Node.js=9.6.0-alpha48
parseplatform Parse-server Node.js=9.6.0-alpha49
parseplatform Parse-server Node.js=9.6.0-alpha5
parseplatform Parse-server Node.js=9.6.0-alpha50
parseplatform Parse-server Node.js=9.6.0-alpha51
parseplatform Parse-server Node.js=9.6.0-alpha52
parseplatform Parse-server Node.js=9.6.0-alpha53
parseplatform Parse-server Node.js=9.6.0-alpha6
parseplatform Parse-server Node.js=9.6.0-alpha7
parseplatform Parse-server Node.js=9.6.0-alpha8
parseplatform Parse-server Node.js=9.6.0-alpha9

Remediation

Patch Available

https://github.com/parse-community/parse-server/commit/5e70094250a36bfcc14ecd49592be2b94fba66ff

Patch Available

https://github.com/parse-community/parse-server/commit/fc3da35a81d5083b453e8967cabcc880f1a3bd0c

Event History

Mar 24, 2026
CVE Published
via MITRE·06:28 PM
Data Sourced
via MITRE·06:28 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·07:48 PM
Data Sourced
via GitHub·07:48 PM
DescriptionWeaknessAffected Software
Sep 22, 58202
Event
via FIRST·03:00 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-33624?

CVE-2026-33624 has a high severity rating due to the potential for unauthorized access through the reuse of MFA recovery codes.

2

How do I fix CVE-2026-33624?

To fix CVE-2026-33624, upgrade your Parse Server to version 8.6.60 or 9.6.0-alpha.54 or later.

3

What type of vulnerability is CVE-2026-33624?

CVE-2026-33624 is a single-use MFA recovery code bypass vulnerability that can be exploited via concurrent requests.

4

Who is affected by CVE-2026-33624?

CVE-2026-33624 affects users of Parse Server versions below 8.6.60 and 9.6.0-alpha.54.

5

What are the potential consequences of CVE-2026-33624?

If exploited, CVE-2026-33624 can lead to unauthorized access to user accounts by allowing the reuse of recovery codes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203