Executive brief
Parse Server is an open-source backend framework used to build and host applications. A security flaw in its login process allows an attacker with a stolen password and a single multi-factor authentication (MFA) code to create multiple active sessions simultaneously. This bypasses the security rule that MFA codes should only work once, potentially allowing an attacker to maintain access even if a user tries to log them out.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in the Parse Server authData login endpoint. By sending concurrent login requests using a single-use MFA recovery code or SMS OTP, an attacker can bypass the single-use guarantee and establish multiple authenticated sessions. This occurs because the system fails to invalidate the token before subsequent concurrent requests are processed. The vulnerability is exploited via the network but requires the attacker to already possess valid authentication credentials and a valid MFA token. The issue has been addressed in versions 8.6.64 and 9.7.0-alpha.8 by implementing optimistic locking on the authData login path to prevent concurrent database updates for the same user.
Affected products
- Parse Platform Parse Server < 8.6.64, >= 9.0.0 < 9.7.0-alpha.8
Timeline
- 2026-03-26: patched: Fixes merged in PR #10326 and #10327
- 2026-03-26: advisory: GitHub Security Advisory GHSA-w73w-g5xw-rwhf published
- 2026-03-31: disclosed: CVE-2026-34224 published to NVD
References
- https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92
- https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf
- https://github.com/parse-community/parse-server/pull/10326
- https://github.com/parse-community/parse-server/pull/10327
- https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf