Parse Server: MFA recovery code single-use bypass via concurrent requests

THẤP 2.7CVE-2026-33624 · BIT-parse-2026-33624 · GHSA-2299-ghjr-6vjp · Công bố 24/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-33624 là lỗ hổng mức THẤP (CVSS 2.7) ảnh hưởng parse-server (parseplatform), parse-server.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.18%, cao hơn 7.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.6.0, 8.6.60, 9.6.0-alpha.54 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
parse-server parseplatform	`= 9.6.0≥ 9.0.0, < 9.6.0< 8.6.60`	`9.6.08.6.60`
parse-server npm	`≥ 9.0.0, < 9.6.0-alpha.54< 8.6.60`	`9.6.0-alpha.548.6.60`

Mô tả

Impact

An attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds.

Patches

The login handler now uses optimistic locking when updating auth data that contains consumed single-use tokens. If a concurrent request has already modified the recovery array, the update fails and the login is rejected.

Workarounds

There are no known workarounds.

Mô tả của NVD

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.