A flaw in Parse Server allows an attacker with a valid authentication provider token and a single MFA recovery or SMS one‑time password to send concurrent login requests via the authData endpoint. This bypasses the expected single‑use nature of the MFA token, enabling the creation of multiple active sessions. Consequently, an attacker can maintain authenticated access even after the legitimate user revokes detected sessions, undermining the integrity of MFA protection.

Parse Server, the open source backend from parse-community, is affected. Any deployment running a version earlier than 8.6.64 or earlier than 9.7.0-alpha.8 is vulnerable. The product runs in a Node.js environment.

The vulnerability is rated as low severity and has a very low probability of exploitation. It is not listed in CISA's catalog of known exploited vulnerabilities, indicating no confirmed real‑world attacks to date. Exploitation requires the attacker to hold a valid provider token and a single MFA code and to issue several concurrent login requests. While the risk is modest, the impact on the MFA enforcement mechanism is notable.