CVE-2026-34224
Parse Server: MFA single-use token bypass via concurrent authData login requests
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.
INFO
Published Date :
March 31, 2026, 3:16 p.m.
Last Modified :
April 2, 2026, 4:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Update Parse Server to version 8.6.64 or later.
- Update Parse Server to version 9.7.0-alpha.8 or later.
- Ensure MFA and OTP mechanisms are properly validated.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-34224.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-34224 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-34224
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-34224 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-34224 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N -
Initial Analysis by [email protected]
Apr. 01, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N Added CPE Configuration OR *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions from (including) 9.0.0 up to (excluding) 9.7.0 *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha1:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha2:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha3:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha4:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha5:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha6:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha7:*:*:*:node.js:*:* *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions up to (excluding) 8.6.64 Added Reference Type GitHub, Inc.: https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf Types: Patch Added Reference Type GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10326 Types: Issue Tracking, Patch Added Reference Type GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10327 Types: Issue Tracking, Patch Added Reference Type GitHub, Inc.: https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf Types: Patch, Vendor Advisory -
New CVE Received by [email protected]
Mar. 31, 2026
Action Type Old Value New Value Added Description Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-367 Added Reference https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92 Added Reference https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf Added Reference https://github.com/parse-community/parse-server/pull/10326 Added Reference https://github.com/parse-community/parse-server/pull/10327 Added Reference https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf