8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31875

CVE-2026-31875: Parse Server MFA recovery codes not consumed after use

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as a fallback when the user cannot provide a TOTP token. However, recovery codes are not consumed after use, allowing the same recovery code to be used an unlimited number of times. This defeats the single-use design of recovery codes and weakens the security of MFA-protected accounts. An attacker who obtains a single recovery code can repeatedly authenticate as the affected user without the code ever being invalidated. This vulnerability is fixed in 9.6.0-alpha.7 and 8.6.33.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31875

CVE-2026-31875:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.6.0-alpha.7	9.6.0-alpha.7
parse-server	npm	< 8.6.33	8.6.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Parse Server's multi-factor authentication (MFA) implementation, specifically concerning the handling of recovery codes. When a user logs in using a recovery code, the server should invalidate that code to prevent its reuse. The analysis of the provided patches shows that the vulnerability is located in the src/Adapters/Auth/mfa.js file. The commits cdc973c3585d8c3dc0f3e57ac64f7b94e641742f and 5cb4df5df7a43ea6a51bbee22b8951bd1f80b28d (for different branches) clearly show the fix. The vulnerable code simply checked for the existence of the recovery code (if (recovery[0] === token || recovery[1] === token)) and, if valid, allowed the login without consuming the code. The patch modifies this logic to find the index of the used recovery code, remove it from the user's authData, and then save the updated user object. The function containing this logic is MFAAdapter.validateAuthData. An attacker who obtains a user's recovery code could exploit this flaw to gain persistent access to the account, as the code would never be invalidated.

Vulnerable functions

MFAAdapter.validateAuthData

src/Adapters/Auth/mfa.js

The `validateAuthData` function in the `MFAAdapter` class checks if the provided token is a valid recovery code. In the vulnerable version, if the token matches a recovery code, the function returns a successful response without removing the used code from the list of valid recovery codes. This allows the same recovery code to be used multiple times, defeating its purpose as a single-use token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.