CVE-2026-53725: Parse Server MFA secret disclosure in login and verifyPassword endpoints

CVE-2026-53725 · Severity: medium · CVSS 4 · Published 2026-06-12

Parse Server, an open-source backend framework, contains a vulnerability that can expose sensitive user information. If multi-factor authentication (MFA) is enabled and specific permissions are set to restrict user data access, the system may inadvertently reveal MFA secrets and recovery codes during login or password verification. An attacker who already knows a user's password could use this flaw to obtain their second-factor secrets, effectively bypassing MFA protections.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-53725 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53725 being exploited in the wild.
How severe is CVE-2026-53725?
Medium severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?
parse-server (npm) >= 9.8.0, < 9.9.1-alpha.5, SEMVER:introduced=9.8.0,fixed=9.9.1-alpha.5.
Is there a fix for CVE-2026-53725?
Yes. parse-server (npm): upgrade to 9.9.1-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53725 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53725?
Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • parse-server (npm): upgrade to 9.9.1-alpha.5 or later
    npm install parse-server@9.9.1-alpha.5

Technical details

An information disclosure vulnerability exists in Parse Server's `/login` and `/verifyPassword` endpoints due to an insecure fallback mechanism. When Class-Level Permissions (CLP) deny a 'get' request on the `_User` class, the server fails to properly sanitize the response and instead falls back to returning the raw database row. This bypasses `protectedFields` and auth-adapter sanitizers, exposing sensitive `authData` such as TOTP secrets and recovery codes. An attacker with valid user credentials can exploit this to retrieve MFA secrets, facilitating a full MFA bypass. The issue affects versions 9.8.0 through 9.9.1-alpha.5 and is fixed in version 9.9.1-alpha.5.

Affected products

  • parse-community parse-server >= 9.8.0, < 9.9.1-alpha.5

Identifiers

  • CVE-2026-53725
  • GHSA-75v4-m273-5j49

Timeline

  • 2026-06-03: disclosed: Initial report to parse-community
  • 2026-06-12: advisory: NVD publication date
  • 2026-06-19: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.