{"action":"Upgrade parse-server to 8.6.60 or later.","affected":[{"fixed":"9.6.0-alpha.54","introduced":"9.0.0"},{"fixed":"8.6.60","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-33624"],"ecosystem":"npm","epss":0.00182,"exploited":false,"fixed_versions":["9.6.0-alpha.54","8.6.60"],"ghsa_id":"GHSA-2299-ghjr-6vjp","id":"tcs_01M5KERKMQA9S04MP187SNQEQC","modified_at":"2026-03-27T22:11:19.871863Z","published_at":"2026-03-24T19:48:24Z","references":["https://osv.dev/vulnerability/GHSA-2299-ghjr-6vjp","https://github.com/parse-community/parse-server/security/advisories/GHSA-2299-ghjr-6vjp","https://nvd.nist.gov/vuln/detail/CVE-2026-33624","https://github.com/parse-community/parse-server/pull/10275","https://github.com/parse-community/parse-server/pull/10276","https://github.com/parse-community/parse-server/commit/5e70094250a36bfcc14ecd49592be2b94fba66ff","https://github.com/parse-community/parse-server/commit/fc3da35a81d5083b453e8967cabcc880f1a3bd0c","https://github.com/parse-community/parse-server"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"GHSA-2299-ghjr-6vjp","url":"https://osv.dev/vulnerability/GHSA-2299-ghjr-6vjp"},{"source":"nvd","source_id":"CVE-2026-33624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33624"}],"summary":"Parse Server: MFA recovery code single-use bypass via concurrent requests"}