Parse Server exposes auth data via verify password endpoint

Description

The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user’s password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.63

  >= 9.0.0, < 9.7.0-alpha.7**

• Patched version(s): **8.6.63

  9.7.0-alpha.7**

References

• GHSA-wp76-gg32-8258
• CVE-2026-34215
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server exposes auth data via /users/me endpoint - CVE-2026-33627
• Parse Server: Account takeover via operator injection in authentication data identifier - CVE-2026-32248
• Parse Server vulnerable to user enumeration via email verification endpoint - CVE-2026-31901
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364

You might also like:

How do hackers hack websites?

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

parse-server