QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-34224

Back to search

CVE-2026-34224

Published: Mar 31, 2026

Modified: Apr 2, 2026

PUBLISHED

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.

VendorProductVersions

parse-community

parse-server

affected
< 8.6.64
affected
>= 9.0.0, < 9.7.0-alpha.8

Weaknesses (CWE)

CWE-367

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now