CVE-2026-53725: Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Impact
Apps that enable MFA and deny get on the User class via Class-Level Permissions could expose sensitive user data through the /login and /verifyPassword endpoints.
These endpoints re-fetch the user through the access-controlled query pipeline (CLP, protectedFields, auth-adapter sanitizers) before responding. When that re-fetch was denied by the User get permission, the server fell back to the raw database row, exposing raw authData (including MFA TOTP secrets and recovery codes) and fields hidden by protectedFields (when protectedFieldsOwnerExempt is false).
/verifyPassword is the most severe: with only a username and password (no session or MFA token), an attacker who knows a victim's password could retrieve their MFA secret and recovery codes, defeating the second factor.
Only Parse Server 9.8.0 and later are affected; 8.x and earlier are not. Master and maintenance key requests are unaffected, as they bypass these controls by design.
Patches
On a denied re-fetch, /login and /verifyPassword no longer fall back to the raw row; they return only the user's identity (plus the session token for /login). Master and maintenance key callers still receive the full record.
Workarounds
None that preserve the intended User get restriction. Upgrade to a patched version.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA and deny get on the User class via Class-Level Permissions could expose sensitive user data through the /login and /verifyPassword endpoints. These endpoints re-fetch the user through the access-controlled query pipeline (CLP, protectedFields, auth-adapter sanitizers) before responding. When that re-fetch was denied by the User get permission, the server fell back to the raw database row, exposing raw authData (including MFA TOTP secrets and recovery codes) and fields hidden by protectedFields (when protectedFieldsOwnerExempt is false). /verifyPassword is the most severe: with only a username and password (no session or MFA token), an attacker who knows a victim's password could retrieve their MFA secret and recovery codes, defeating the second factor. This issue has been patched in version 9.9.1-alpha.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 9.9.1-alpha.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53725?
The severity of CVE-2026-53725 is classified as medium with a CVSS score of 5.9.
How do I fix CVE-2026-53725?
To fix CVE-2026-53725, upgrade Parse Server to version 9.9.1-alpha.5 or later.
What user data is exposed in CVE-2026-53725?
CVE-2026-53725 discloses MFA secrets and protected fields when access to the _User class is denied.
Which versions are affected by CVE-2026-53725?
CVE-2026-53725 affects Parse Server versions from 9.8.0 to before 9.9.1-alpha.5.
What are the implications of CVE-2026-53725 for applications using Parse Server?
Applications using Parse Server with MFA enabled may unintentionally expose sensitive user data through the /login and /verifyPassword endpoints.