CVE-2026-34215

Published: Mar 31, 2026Modified: Jul 24, 2026

8.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. This issue has been patched in versions 8.6.63 and 9.7.0-alpha.7.

Affected (8)

Products: Parseplatform: Parse Server

Parseplatform

1 product

Parse Server

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Parseplatform Parse Server	Before 8.6.63
Parseplatform Parse Server	From 9.0.0 to 9.7.0
Parseplatform Parse Server	Version 9.7.0 alpha1
Parseplatform Parse Server	Version 9.7.0 alpha2
Parseplatform Parse Server	Version 9.7.0 alpha3
Parseplatform Parse Server	Version 9.7.0 alpha4
Parseplatform Parse Server	Version 9.7.0 alpha5
Parseplatform Parse Server	Version 9.7.0 alpha6