CVE-2026-33624: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33624 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Parse Server's MFA recovery code implementation that allows an attacker to reuse a single-use MFA recovery code an unlimited number of times. It affects Parse Server versions prior to 8.6.60 and versions 9.0.0 through 9.6.0-alpha.53 (for Node.js). The vulnerability was published on March 22, 2026, and patched the same day. It carries a CVSS v4.0 base score of 2.1 (Low) and a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory).

The root cause is a CWE-367 (Time-of-Check Time-of-Use Race Condition) flaw in src/Routers/UsersRouter.js. When a user logs in with an MFA recovery code, the server reads the current recovery code array, validates the code, and then updates the database to remove the consumed code — but without any concurrency control. By sending multiple concurrent POST /1/login requests within milliseconds using the same recovery code, multiple requests can pass the validation check before any of them commits the removal, allowing the code to be consumed more than once. The fix introduces optimistic locking: the database UPDATE for _User.authData now includes a WHERE predicate matching the original array value; if a concurrent request has already modified the array, the update finds zero rows and the login is rejected with SCRIPT_FAILED: 'Invalid auth data' (GitHub Advisory, Commit 5e70094).

Successful exploitation allows an attacker who has already obtained a target user's password and a single valid MFA recovery code to bypass multi-factor authentication protections and gain unauthorized, repeated account access. The integrity impact is limited (low) — the attacker can authenticate as the victim and perform any actions permitted to that account — while confidentiality and availability are not directly impacted by the vulnerability itself. There is no lateral movement inherent to the flaw, but account takeover could enable further actions depending on the application's privilege model (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (0.000380), indicating a very low probability of exploitation in the near term. Exploitation requires the attacker to already possess the victim's password and a valid recovery code, significantly raising the bar for abuse.

1. Credential acquisition: Obtain the target user's password through phishing, credential stuffing, or a prior data breach, and acquire at least one valid MFA recovery code (e.g., via social engineering or prior access to the user's recovery code storage).
2. Identify target endpoint: Confirm the Parse Server instance is running a vulnerable version (< 8.6.60 or 9.0.0–9.6.0-alpha.53) and that MFA is enabled.
3. Craft concurrent login requests: Prepare multiple simultaneous HTTP POST requests to POST /1/login with the following body, substituting the obtained credentials and recovery code:

{
  "username": "<target_user>",
  "password": "<password>",
  "authData": {
    "mfa": {
      "token": "<recovery_code>"
    }
  }
}

4. Race the TOCTOU window: Send 10 or more of these requests simultaneously (e.g., using Promise.allSettled in Node.js or parallel curl invocations) within milliseconds to exploit the window between the server's code validation check and the database update that marks the code as consumed.
5. Achieve authentication: One or more concurrent requests will succeed, returning a valid session token. The attacker can use this session token to authenticate as the victim for subsequent API calls (GitHub Advisory, Commit 5e70094).

• Network: Burst of concurrent POST /1/login HTTP requests from the same source IP within milliseconds, all using identical request bodies (same username and MFA recovery code token).
• Logs: Parse Server access logs showing multiple simultaneous login attempts for the same user with the same authData.mfa.token value, where more than one request returns HTTP 200 in rapid succession.
• Logs: Subsequent authentication events for the same user account from unexpected IP addresses or geographic locations shortly after the concurrent login burst.
• Application: Multiple active session tokens issued for the same user account within a very short time window, visible in the _Session class.

Upgrade Parse Server to version 8.6.60 (for the 8.x LTS branch) or 9.6.0-alpha.54 (or later, including the stable 9.6.0 release) to apply the fix. The patch introduces optimistic locking on the _User.authData update, ensuring only one concurrent login request can successfully consume a recovery code. There are no known workarounds for unpatched versions; upgrading is the only remediation. As a supplementary measure, implement rate limiting on the login endpoint and advise users to regenerate their MFA recovery codes after updating (GitHub Advisory, PR #10276).