PT-2026-24690 · Bitnami+4 · Parse+1

0Xkakash1 · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31875

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.7 Parse Server versions prior to 8.6.33

Description Parse Server, a backend deployable on Node.js infrastructures, is affected by an issue where recovery codes for multi-factor authentication (MFA) via TOTP are not consumed after use. This allows an attacker who obtains a single recovery code to repeatedly authenticate as the affected user without the code being invalidated, undermining the intended single-use design and weakening the security of MFA-protected accounts. The issue arises when MFA via TOTP is enabled for a user account, and Parse Server generates two single-use recovery codes intended as a fallback when a TOTP token is unavailable.

Recommendations Versions prior to 9.6.0-alpha.7 should be updated to version 9.6.0-alpha.7 or later. Versions prior to 8.6.33 should be updated to version 8.6.33 or later.

Exploit

Fix

Weakness Enumeration

CWE-672

Related Identifiers

BIT-PARSE-2026-31875

CVE-2026-31875

GHSA-4HF6-3X24-C9M8

Affected Products

Parse

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31875.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4hf6-3x24-c9m8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31875 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31875 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31875 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hf6-3x24-c9m8 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.7 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.33 · Note
• https://reddit.com/r/VulnMatter/comments/1rqu37b/resumen_diario_de_vulnerabilidades_11032026 · Reddit Post
• https://twitter.com/dailycve/status/2031906722827096274 · Twitter Post
• https://twitter.com/CVEnew/status/2031992390786171260 · Twitter Post