4.4

CVE-2026-34224

Parse Server: MFA single-use token bypass via concurrent authData login requests

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.64
Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.7.0
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha1 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha2 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha3 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha4 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha5 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha6 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.7.0 Update alpha7 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.226
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.4 0.7 3.6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
security-advisories@github.com 2.1 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA-ADP 4.4 0.7 3.6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

https://github.com/parse-community/parse-server/pull/10326
Patch
Issue Tracking
https://github.com/parse-community/parse-server/pull/10327
Patch
Issue Tracking
https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92
Patch
https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf
Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf
Patch
Vendor Advisory