CVE-2026-34215: Parse Server exposes auth data via verify password endpoint
(updated )
The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user’s password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.
References
- github.com/advisories/GHSA-wp76-gg32-8258
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c
- github.com/parse-community/parse-server/commit/770be8647424d92f5425c41fa81065ffbbb171ed
- github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f
- github.com/parse-community/parse-server/commit/a1d4e7b12a12f16d3870dbee582a36765858e94c
- github.com/parse-community/parse-server/pull/10278
- github.com/parse-community/parse-server/pull/10279
- github.com/parse-community/parse-server/pull/10323
- github.com/parse-community/parse-server/pull/10324
- github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258
- nvd.nist.gov/vuln/detail/CVE-2026-34215
Code Behaviors & Features
Detect and mitigate CVE-2026-34215 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →