Executive Summary

This vulnerability affects Parse Server versions prior to 8.6.60 and 9.6.0-alpha.54. An attacker who has obtained both a user's password and a single multi-factor authentication (MFA) recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This behavior defeats the intended single-use design of MFA recovery codes.

To exploit this vulnerability, the attacker must have the user's password, a valid recovery code, and the capability to send multiple login requests within milliseconds concurrently. The issue has been fixed in the specified patched versions.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker who already has a user's password and one MFA recovery code to bypass the intended security mechanism that limits recovery code usage to a single time. By reusing the recovery code multiple times through concurrent login attempts, the attacker can repeatedly gain unauthorized access to the user's account.

This undermines the security provided by MFA recovery codes, potentially leading to unauthorized access, account compromise, and further exploitation depending on the privileges of the compromised account.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Parse Server to version 8.6.60 or later, or to version 9.6.0-alpha.54 or later, where the issue has been patched.

Useful 0 Not Useful 0