Junglewise Threat Intelligence

CVE-2026-34215: Parse Platform Parse Server sensitive information exposure in verify password endpoint

CVE-2026-34215 · Severity: medium · CVSS 6.5 · Published 2026-03-31

Technologies: Parse Platform Parse-Server.

Executive brief

Parse Server is an open-source backend framework used to build and host applications. A security flaw in the password verification process allows sensitive authentication details, such as multi-factor authentication (MFA) secrets and recovery codes, to be exposed to users. If an attacker gains access to a user's password, they can use this flaw to bypass MFA protections and take full control of the account.

Technical details

An information exposure vulnerability exists in Parse Server's 'verify password' endpoint. The endpoint fails to sanitize authentication data before returning it in the response, leaking sensitive fields such as MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who has already obtained a user's password can call this endpoint to retrieve the MFA secret, allowing them to generate valid TOTP codes and bypass multi-factor authentication. The issue is caused by a lack of proper sanitization through auth adapter hooks, which is present in other login endpoints. This has been patched in versions 8.6.63 and 9.7.0-alpha.7.

Affected products

  • Parse Platform Parse Server < 8.6.63, >= 9.0.0 < 9.7.0-alpha.7

Timeline

  • 2026-03-26: patched: Fixes merged in GitHub pull requests #10323 and #10324
  • 2026-03-31: advisory: GitHub Security Advisory GHSA-wp76-gg32-8258 published
  • 2026-03-31: disclosed

References