Executive brief
Parse Server, an open-source backend framework, contains a vulnerability that can expose sensitive user information. If multi-factor authentication (MFA) is enabled and specific permissions are set to restrict user data access, the system may inadvertently reveal MFA secrets and recovery codes during login or password verification. An attacker who already knows a user's password could use this flaw to obtain their second-factor secrets, effectively bypassing MFA protections.
Technical details
An information disclosure vulnerability exists in Parse Server's `/login` and `/verifyPassword` endpoints due to an insecure fallback mechanism. When Class-Level Permissions (CLP) deny a 'get' request on the `_User` class, the server fails to properly sanitize the response and instead falls back to returning the raw database row. This bypasses `protectedFields` and auth-adapter sanitizers, exposing sensitive `authData` such as TOTP secrets and recovery codes. An attacker with valid user credentials can exploit this to retrieve MFA secrets, facilitating a full MFA bypass. The issue affects versions 9.8.0 through 9.9.1-alpha.5 and is fixed in version 9.9.1-alpha.5.
Affected products
- parse-community parse-server >= 9.8.0, < 9.9.1-alpha.5
Timeline
- 2026-06-03: disclosed: Initial report to parse-community
- 2026-06-12: advisory: NVD publication date
- 2026-06-19: advisory: GitHub Advisory published