CVE-2026-34224: Parse Server: MFA single-use token bypass via concurrent authData login requests

Published Mar 29, 2026
·
Updated

Impact

An attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions.

Patches

The fix adds optimistic locking to the authData login path, ensuring that concurrent database updates for the same user fail when the original MFA token array has already been modified by another request.

Workarounds

There is no known workaround.

Other sources

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.

MITRE

Affected Software

11 affected componentsFixes available
npm/parse-server<8.6.64
8.6.64
npm/parse-server>=9.0.0<9.7.0-alpha.8
9.7.0-alpha.8
parseplatform Parse-server Node.js<8.6.64
parseplatform Parse-server Node.js>=9.0.0<9.7.0
parseplatform Parse-server Node.js=9.7.0-alpha1
parseplatform Parse-server Node.js=9.7.0-alpha2
parseplatform Parse-server Node.js=9.7.0-alpha3
parseplatform Parse-server Node.js=9.7.0-alpha4
parseplatform Parse-server Node.js=9.7.0-alpha5
parseplatform Parse-server Node.js=9.7.0-alpha6
parseplatform Parse-server Node.js=9.7.0-alpha7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/parse-server to a version that resolves this vulnerability.

    Fixed in 8.6.64
  2. Upgrade

    Upgrade npm/parse-server to a version that resolves this vulnerability.

    Fixed in 9.7.0-alpha.8
  3. Upgrade

    Upgrade Parse Server to a version that resolves this vulnerability.

    Fixed in 8.6.64
  4. Upgrade

    Upgrade Parse Server to a version that resolves this vulnerability.

    Fixed in 9.7.0-alpha.8

Event History

Mar 29, 2026
Advisory Published
via GitHub·03:23 PM
Data Sourced
via GitHub·03:23 PM
DescriptionWeaknessAffected Software
Mar 31, 2026
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-34224?

CVE-2026-34224 has been classified as a significant vulnerability due to potential multi-session exploits from valid authentication tokens with MFA codes.

2

How do I fix CVE-2026-34224?

To remediate CVE-2026-34224, upgrade to parse-server version 8.6.64 or 9.7.0-alpha.8 or later.

3

What type of attack does CVE-2026-34224 enable?

CVE-2026-34224 enables attackers to bypass the single-use requirement of MFA recovery codes, potentially allowing unauthorized access.

4

Who is affected by CVE-2026-34224?

CVE-2026-34224 affects users of npm's parse-server versions up to 8.6.64 and versions between 9.0.0 and 9.7.0-alpha.8.

5

What components of the system does CVE-2026-34224 impact?

CVE-2026-34224 impacts the authData login endpoint, specifically concerning authentication and multi-factor authentication mechanisms.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203