Vulnerability in Parse-Community Parse-Server
CVE-2026-33624
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
EPSS: 0.002 (7.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Parse-community Parse-server — versions < 8.6.60, >= 9.0.0, < 9.6.0-alpha.54
- Parseplatform Parse-server — versions 9.6.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-33624?
- CVE-2026-33624 is a low-severity vulnerability in Parse-Community Parse-Server, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 2.7/10. Published 2026-03-24.
- How severe is CVE-2026-33624?
- Low severity. CVSS v3 base score is 2.7 out of 10.