CVE-2026-33624: Parse Server: MFA recovery code single-use bypass via concurrent requests
(updated )
An attacker who obtains a user’s password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user’s password, a valid recovery code, and the ability to send concurrent requests within milliseconds.
References
- github.com/advisories/GHSA-2299-ghjr-6vjp
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/commit/5e70094250a36bfcc14ecd49592be2b94fba66ff
- github.com/parse-community/parse-server/commit/fc3da35a81d5083b453e8967cabcc880f1a3bd0c
- github.com/parse-community/parse-server/pull/10275
- github.com/parse-community/parse-server/pull/10276
- github.com/parse-community/parse-server/security/advisories/GHSA-2299-ghjr-6vjp
- nvd.nist.gov/vuln/detail/CVE-2026-33624
Code Behaviors & Features
Detect and mitigate CVE-2026-33624 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →