CVE-2026-34224

Parse Server's authentication system implements MFA recovery codes and SMS one-time passwords as single-use tokens intended to prevent replay attacks and unauthorized session establishment. The vulnerability exists in the authData login endpoint, which processes concurrent login requests without proper synchronization mechanisms. The root cause (CWE-367: Time-of-check to time-of-use race condition) stems from insufficient locking during database operations: when multiple concurrent requests validate and consume an MFA token, the application checks for token validity and updates the token array without atomic guarantees, allowing a second request to pass validation checks before the first request's database update is committed. Parse Server is a Node.js backend framework (pkg:npm/parse-server) that provides BaaS (backend-as-a-service) capabilities, and this vulnerability affects its core authentication layer.