A race condition in Parse Server allows an attacker who knows a user’s password and a single valid MFA recovery code to reuse that code an unlimited number of times by sending concurrent login requests. The flaw undermines the intended single‑use nature of MFA recovery codes, effectively enabling repeated authentication attempts with the same code and weakening the overall multi‑factor protection. The vulnerability is a concurrency issue described by CWE‑367.

Instances of Parse Server running any version prior to 8.6.60 or 9.6.0‑alpha.54 are affected. The product is the open‑source Parse Server backend for Node.js, maintained by the parse‑community community. Vulnerable versions include all releases before the mentioned points, as identified by the provided CPE list.

The CVSS score of 2.1 indicates low severity, and EPSS is under 1%, suggesting limited reported exploitation. However, exploitation requires the attacker to possess a valid user password, a recovery code, and the ability to issue concurrent requests within milliseconds. When those conditions are met, the attacker can reuse the recovery code indefinitely, bypassing MFA benefits. The vulnerability is not listed in the CISA KEV catalog, but patching remains the primary defense.