CVE-2026-53725: medium-severity vulnerability in parse-community parse-server
Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA and deny get on the _User class via Class-Level Permissions could expose sensitive user data through the /login and /verifyPassword endpoints. These endpoints re-fetch the user through the access-controlled query pipeline (CLP, protectedFields, auth-adapter sanitizers) before responding. When that re-fetch was denied by the _User get permission, the server fell back to the raw database row, exposing raw authData (including MFA TOTP secrets and recovery codes) and fields hidden by protectedFields (when protectedFieldsOwnerExempt is false). /verifyPassword is the most severe: with only a username and password (no session or MFA token), an attacker who knows a victim's password could retrieve their MFA secret and recovery codes, defeating the second factor. This issue has been patched in version 9.9.1-alpha.5.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
parse-community · parse-serverRelated CVEs — parse-community parse-server
In the same product, most dangerous first.
CVE-2022-24760CRITICALCommand Injection in Parse serverEPSS 49.4%CVE-2022-39396CRITICALParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserEPSS 38.7%CVE-2024-39309CRITICALZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityEPSS 20.2%CVE-2023-36475CRITICALParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionEPSS 3.2%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-30965CRITICALParse Server session token exfiltration via `redirectClassNameForKey` query parameterEPSS 1.4%