CVE-2026-34224

MEDIUM

Parse Server: MFA single-use token bypass via concurrent authData login requests

Title source: cna

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.

References (5)

Scores

CVSS v3 4.4
EPSS 0.0002
EPSS Percentile 4.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-367
Status published
Products (5)
npm/parse-server 9.0.0 - 9.7.0-alpha.8npm
parse-community/parse-server < 8.6.64
parse-community/parse-server >= 9.0.0, < 9.7.0-alpha.8
parseplatform/parse-server 9.7.0 alpha1 (7 CPE variants)
parseplatform/parse-server < 8.6.64
Published Mar 31, 2026
Tracked Since Mar 31, 2026