CVE-2026-31875
Received Received - Intake
Recovery Code Reuse Vulnerability in Parse Server MFA

Publication date: 2026-03-11

Last updated on: 2026-03-13

Assigner: GitHub, Inc.

Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as a fallback when the user cannot provide a TOTP token. However, recovery codes are not consumed after use, allowing the same recovery code to be used an unlimited number of times. This defeats the single-use design of recovery codes and weakens the security of MFA-protected accounts. An attacker who obtains a single recovery code can repeatedly authenticate as the affected user without the code ever being invalidated. This vulnerability is fixed in 9.6.0-alpha.7 and 8.6.33.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31875
EUVD
EUVD-2026-11280
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
parseplatform parse-server 9.6.0
parseplatform parse-server 9.6.0
parseplatform parse-server 9.6.0
parseplatform parse-server 9.6.0
parseplatform parse-server 9.6.0
parseplatform parse-server 9.6.0
parseplatform parse-server From 9.0.0 (inc) to 9.6.0 (exc)
parseplatform parse-server to 8.6.33 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-31875 is a vulnerability in Parse Server versions prior to 9.6.0-alpha.7 and 8.6.33 that affects multi-factor authentication (MFA) using TOTP. When MFA is enabled, Parse Server generates two single-use recovery codes as a fallback for users who cannot provide a TOTP token. However, due to this vulnerability, these recovery codes are not consumed or invalidated after use, allowing the same recovery code to be used repeatedly.

This flaw defeats the intended single-use design of recovery codes and weakens the security of MFA-protected accounts. An attacker who obtains one recovery code can repeatedly authenticate as the affected user without the code ever being revoked or invalidated.

Impact Analysis

This vulnerability can have a significant security impact by allowing unauthorized access to user accounts protected by MFA. Since recovery codes can be reused indefinitely, an attacker who obtains a single recovery code can repeatedly authenticate as the user without needing the TOTP token.

This undermines the security benefits of MFA, potentially leading to unauthorized access to sensitive data or systems, identity impersonation, and other security breaches.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Parse Server to version 9.6.0-alpha.7 or later, or to version 8.6.33 or later. These versions include a fix that ensures recovery codes are consumed and invalidated immediately after use, preventing reuse.

No known workarounds exist, so applying the patch is the only effective mitigation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart