Multi-Factor Authentication Flaw in Parse Server Affects User Account Security
CVE-2026-31875
What is CVE-2026-31875?
Parse Server, an open-source backend framework, has a vulnerability affecting its multi-factor authentication (MFA) implementation. The issue arises when TOTP is enabled for user accounts, as the server generates two single-use recovery codes intended for emergency access. However, these recovery codes are not marked as used after being deployed, allowing attackers to exploit them. If a malicious actor gains access to any one of these codes, they can authenticate as the user indefinitely, bypassing the intended security measures. This vulnerability undermines the effectiveness of MFA, potentially exposing user accounts to unauthorized access. The issue has been addressed in Parse Server versions 9.6.0-alpha.7 and 8.6.33.
Affected Version(s)
parse-server >= 9.0.0 < 9.6.0-alpha.7 < 9.0.0 9.6.0-alpha.7
parse-server < 8.6.33 < 8.6.33