Is CVE-2026-34215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34215 being exploited in the wild.

How severe is CVE-2026-34215?

Medium severity, with a CVSS score of 6.5, published 31 March 2026.

Which products and versions are affected?

parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.7.0-alpha.7.

Is there a fix for CVE-2026-34215?

Yes. parse-server (npm): upgrade to 9.7.0-alpha.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34215?

Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34215: Parse Platform Parse Server sensitive information exposure in verify password endpoint

CVE-2026-34215 · Severity: medium · CVSS 6.5 · Published 2026-03-31

Parse Server is an open-source backend framework used to build and host applications. A security flaw in the password verification process allows sensitive authentication details, such as multi-factor authentication (MFA) secrets and recovery codes, to be exposed to users. If an attacker gains access to a user's password, they can use this flaw to bypass MFA protections and take full control of the account.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-34215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34215 being exploited in the wild.
How severe is CVE-2026-34215?: Medium severity, with a CVSS score of 6.5, published 31 March 2026.
Which products and versions are affected?: parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.7.0-alpha.7.
Is there a fix for CVE-2026-34215?: Yes. parse-server (npm): upgrade to 9.7.0-alpha.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34215?: Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-server (npm): upgrade to 9.7.0-alpha.7 or later
```
npm install parse-server@9.7.0-alpha.7
```

Technical details

An information exposure vulnerability exists in Parse Server's 'verify password' endpoint. The endpoint fails to sanitize authentication data before returning it in the response, leaking sensitive fields such as MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who has already obtained a user's password can call this endpoint to retrieve the MFA secret, allowing them to generate valid TOTP codes and bypass multi-factor authentication. The issue is caused by a lack of proper sanitization through auth adapter hooks, which is present in other login endpoints. This has been patched in versions 8.6.63 and 9.7.0-alpha.7.

Affected products

Parse Platform Parse Server < 8.6.63, >= 9.0.0 < 9.7.0-alpha.7

Identifiers

CVE-2026-34215
GHSA-wp76-gg32-8258

Timeline

2026-03-26: patched: Fixes merged in GitHub pull requests #10323 and #10324
2026-03-31: advisory: GitHub Security Advisory GHSA-wp76-gg32-8258 published
2026-03-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.