CVE-2026-34215
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Parse Server prior to versions 8.6.63 and 9.7.0-alpha.7 returns unsanitized authentication data from the verify password endpoint, including MFA TOTP secrets, recovery codes, and OAuth tokens. An attacker who knows the user's password can extract the MFA secret and generate valid MFA codes.
Risk Assessment
Multi-factor authentication (MFA) can be completely bypassed, allowing an attacker to take over the user's account.
Recommendation
Upgrade Parse Server to version 8.6.63 or 9.7.0-alpha.7 (or later).
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. This issue has been patched in versions 8.6.63 and 9.7.0-alpha.7.