CVE-2026-31875
Recovery Code Reuse Vulnerability in Parse Server MFA
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | From 9.0.0 (inc) to 9.6.0 (exc) |
| parseplatform | parse-server | to 8.6.33 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-672 | The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31875 is a vulnerability in Parse Server versions prior to 9.6.0-alpha.7 and 8.6.33 that affects multi-factor authentication (MFA) using TOTP. When MFA is enabled, Parse Server generates two single-use recovery codes as a fallback for users who cannot provide a TOTP token. However, due to this vulnerability, these recovery codes are not consumed or invalidated after use, allowing the same recovery code to be used repeatedly.
This flaw defeats the intended single-use design of recovery codes and weakens the security of MFA-protected accounts. An attacker who obtains one recovery code can repeatedly authenticate as the affected user without the code ever being revoked or invalidated.
How can this vulnerability impact me? :
This vulnerability can have a significant security impact by allowing unauthorized access to user accounts protected by MFA. Since recovery codes can be reused indefinitely, an attacker who obtains a single recovery code can repeatedly authenticate as the user without needing the TOTP token.
This undermines the security benefits of MFA, potentially leading to unauthorized access to sensitive data or systems, identity impersonation, and other security breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Parse Server to version 9.6.0-alpha.7 or later, or to version 8.6.33 or later. These versions include a fix that ensures recovery codes are consumed and invalidated immediately after use, preventing reuse.
No known workarounds exist, so applying the patch is the only effective mitigation.