p PatchFirst

CVE-2026-33624

CVE-2026-33624 · Parse Server: MFA recovery code single-use bypass via concurrent requests

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.

CVSS 2.1 · Baja · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • parse-server

    Versiones
    • < 8.6.60: Afectada
    • >= 9.0.0, < 9.6.0-alpha.54: Afectada

    Sin corrección publicada

  • parse-server npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 9.0.0, < 9.6.0-alpha.54

    Actualiza a 9.6.0-alpha.54

  • parse-server npm

    Intervalos de versiones afectados
    • SEMVER: < 8.6.60

    Actualiza a 8.6.60

Fuentes originales

Comprueba tu servidor →