Prior to version 9.6.0-alpha.7 and 8.6.33, Parse Server generates two single-use recovery codes for users with Multi‑Factor Authentication (MFA) via TOTP. Because these codes are not consumed after use, an attacker who obtains any single recovery code can use it repeatedly to authenticate as the affected user, effectively bypassing the MFA protection. The vulnerability is rooted in CWE‑672 (Use of a resource that does not allow duplication of a required unique behaviour). It compromises the confidentiality and integrity of user accounts by allowing unlimited reuse of a recovery token intended to be one‑time.

All instances of parse-server from the parse-community that are running any version earlier than 9.6.0-alpha.7 or 8.6.33 are affected. The vulnerability is present in the open source Parse Server and can be found in all CPE entries for parse-server up to those release points.

The CVSS score of 8.2 indicates a high severity impact. The EPSS score is reported as less than 1%, suggesting a low probability of immediate exploitation in the wild, and it is not listed in the CISA KEV catalog. However, once a recovery code is compromised, exploitation is trivial: an attacker can log in remotely using the code, as the attack vector is likely remote and requires only possession of the code. The impact is international, affecting any deployment where MFA relies on these recovery codes."