GitHub Advisoryadvisory · npm
GHSA-wp76-gg32-8258 Parse Server exposes auth data via verify password endpoint
HIGH
Official page ↗
- Aliases
- CVE-2026-34215
- Ecosystem
- npm
- Packages
- parse-server
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- Weaknesses
- CWE-200
- Reviewed
- 2026-03-29
Affected packages
• npm parse-server: >= 9.0.0, < 9.7.0-alpha.7 → fixed in 9.7.0-alpha.7
• npm parse-server: < 8.6.63 → fixed in 8.6.63
Description
Impact
The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.
Patches
The verify password endpoint now sanitizes authentication data through auth adapter hooks before returning the response, consistent with login and user retrieval endpoints.
Workarounds
There is no known workaround.
Related
Alias · CVE (1)
- CVE-2026-34215 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-34215 advisory
- https://github.com/parse-community/parse-server/pull/10278 web
- https://github.com/parse-community/parse-server/pull/10279 web
- https://github.com/parse-community/parse-server/pull/10323 web
- https://github.com/parse-community/parse-server/pull/10324 web
- https://github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c web
- https://github.com/parse-community/parse-server/commit/770be8647424d92f5425c41fa81065ffbbb171ed web
- https://github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f web
- https://github.com/parse-community/parse-server/commit/a1d4e7b12a12f16d3870dbee582a36765858e94c web
- https://github.com/parse-community/parse-server package