Cyber Resilience

CVE-2026-33624

Race Condition in Parseplatform Parse-Server ≤ 8.6.60

Race Condition
Published
24 March 2026
Modified
25 March 2026
Patch / advisory
View advisory
CVSS Score v4 2.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 7th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-33624 is a low-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Multi-Factor Authentication (T1556.006); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that…

more

recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.

CWE(s)
CWE-367

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1556.006 Multi-Factor Authentication Defense Impairment
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Vulnerability enables repeated use of MFA recovery codes via TOCTOU race condition, directly subverting MFA enforcement (T1556.006) and allowing login with valid accounts (T1078).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-34224Same product: Parseplatform Parse-Server
CVE-2026-32943Same product: Parseplatform Parse-Server
CVE-2026-31875Same product: Parseplatform Parse-Server
CVE-2026-34574Same product: Parseplatform Parse-Server
CVE-2026-27804Same product: Parseplatform Parse-Server
CVE-2026-33409Same product: Parseplatform Parse-Server
CVE-2026-32248Same product: Parseplatform Parse-Server
CVE-2026-32242Same product: Parseplatform Parse-Server
CVE-2026-30949Same product: Parseplatform Parse-Server
CVE-2026-30229Same product: Parseplatform Parse-Server

Affected Assets

parseplatform
parse-server
9.6.0 · ≤ 8.6.60 · 9.0.0 — 9.6.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • IA-5 Authenticator Management
  • AC-10 Concurrent Session Control
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces single-use semantics on MFA recovery codes so concurrent login attempts cannot bypass the consumption check.

IA-5 Authenticator Management good match
prevent

Requires proper lifecycle and atomic consumption rules for recovery-code authenticators, eliminating the TOCTOU flaw described in CWE-367.

AC-10 Concurrent Session Control partial match
prevent

Limits concurrent authentication sessions, reducing the attack window for parallel recovery-code submissions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References