CVE-2026-34215: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34215 is an information disclosure vulnerability in Parse Server, an open-source backend framework for Node.js, where the /verifyPassword endpoint returns unsanitized authentication data including MFA TOTP secrets, recovery codes, and OAuth access tokens. It affects all versions of parse-server (npm) prior to 8.6.63 and versions 9.0.0 through 9.7.0-alpha.6. The vulnerability was disclosed on March 26, 2026, and published to the GitHub Advisory Database on March 29, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.2 (High) (Github Advisory).

The root cause is a missing afterFind hook invocation in the handleVerifyPassword() method within src/Routers/UsersRouter.js (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). While the login and user retrieval endpoints correctly call authDataManager.runAfterFind() to sanitize authentication data before returning it to the client, the verify password endpoint omitted this step, causing raw authData — including TOTP secrets in base32 format, MFA recovery codes, and OAuth tokens — to be returned in the response body. The fix, applied in commits 770be86 (v9 branch) and a1d4e7b (v8 branch), adds await req.config.authDataManager.runAfterFind(req, user.authData) before the response is returned, consistent with other authenticated endpoints (Github Advisory, Patch Commit v8).

An attacker who already knows a target user's password can call the /verifyPassword endpoint and extract the raw MFA TOTP secret from the response, enabling them to generate valid one-time codes and completely bypass multi-factor authentication. Additionally, the endpoint leaks MFA recovery codes and OAuth access tokens, which can be used for persistent account access even after a password change. This effectively renders MFA protections meaningless for any user whose password is compromised, enabling full account takeover with no integrity or availability impact to the server itself (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires the attacker to already possess the target user's password (low-privilege authenticated access), limiting opportunistic exploitation. The EPSS score is approximately 0.078%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 5009995) (Feedly).

1. Obtain target credentials: Acquire a valid username and password for a Parse Server user account through phishing, credential stuffing, or other means.
2. Identify the Parse Server instance: Locate the target Parse Server deployment and confirm it is running a vulnerable version (< 8.6.63 or 9.0.0–9.7.0-alpha.6).
3. Call the verifyPassword endpoint: Send an authenticated HTTP POST or GET request to /1/verifyPassword with the known credentials:

   POST /1/verifyPassword HTTP/1.1
   Host: <parse-server-host>
   X-Parse-Application-Id: <app-id>
   X-Parse-REST-API-Key: <rest-key>
   Content-Type: application/json
   
   {"username": "victim@example.com", "password": "knownpassword"}

4. Extract MFA secret from response: Parse the JSON response body for authData.mfa.secret (base32-encoded TOTP secret) and authData.mfa.recovery (recovery codes) or OAuth tokens.
5. Generate valid MFA codes: Use the extracted TOTP secret with a standard TOTP library or authenticator app to generate valid time-based one-time codes.
6. Bypass MFA and achieve account takeover: Use the victim's password combined with the generated TOTP code to authenticate as the victim, fully bypassing MFA protections (Github Advisory, Patch PR #10323).

• Network: Unusual or repeated HTTP POST/GET requests to /1/verifyPassword from a single IP address or user agent, especially for multiple accounts; requests to this endpoint followed immediately by login attempts using MFA codes.
• Logs: Parse Server access logs showing successful verifyPassword calls for accounts that are not the account owner's own session; responses from /verifyPassword containing authData fields with secret or recovery keys (visible in debug/verbose logging modes).
• Behavioral: Successful MFA logins from IP addresses or devices not previously associated with a user account, occurring shortly after a verifyPassword call for that account; unexpected OAuth token usage from new clients.

Upgrade Parse Server to version 8.6.63 (LTS/v8 branch) or 9.7.0-alpha.7 or later (v9 branch, stable as of 9.7.0) to receive the fix. There is no known configuration-based workaround. As a precautionary measure, administrators should review access logs for the /verifyPassword endpoint for suspicious activity, and consider resetting MFA TOTP secrets, recovery codes, and rotating OAuth access tokens for all users. Enforcing strong, unique passwords reduces the prerequisite for exploitation (Github Advisory, Patch PR #10324).

The vulnerability was reported and patched by Parse Server maintainer mtrezza, who authored both fix pull requests (#10323 for v9, #10324 for v8) on the same day as disclosure (March 26, 2026). Automated security tooling (Snyk, CodeRabbit, Codecov) reviewed the patches and found no additional issues. The fix was noted as consistent with a similar prior fix for the /users/me endpoint (GHSA-37mj-c2wf-cx96), suggesting a pattern of missing afterFind sanitization across endpoints (Github Advisory, Patch PR #10323).