[aungzayyanaing]

Updates

• References

Comments
Add the official parse-server 8.6.60 release reference. The release notes describe the MFA recovery code single-use bypass fix and name this advisory (GHSA-2299-ghjr-6vjp); the advisory is fixed in 8.6.60. Reference-only change; no other advisory fields were changed.

[github]

Hi there @mtrezza! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

No active review issues are present; the advisory only adds the official Parse Server 8.6.60 release reference while preserving existing metadata and affected-version information.

No open issues 🎉

What changed in this PR

Adds the official Parse Server 8.6.60 release reference to advisory GHSA-2299-ghjr-6vjp, documenting the release that fixes the MFA recovery-code concurrent-request bypass.

Changes:

• Added a WEB reference to the Parse Server 8.6.60 release.
• Preserved all existing advisory metadata and affected-version information.

File	Description
advisories/​github-reviewed/​2026/​03/​GHSA-2299-ghjr-6vjp/​GHSA-2299-ghjr-6vjp.json	Adds the official Parse Server 8.6.60 release URL to the advisory references.

_{Review effort: Lite (dynamic)}