PT-2026-28613 · Unknown · Parse Server

Offset · CVE-2026-34224 · Publicado 2026-03-29 · Atualizado 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.64 Parse Server versions prior to 9.7.0-alpha.8

Description Parse Server is an open source backend deployable on Node.js infrastructure. An attacker with a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This bypasses the single-use restriction of MFA recovery codes and SMS one-time passwords, enabling session persistence even after the legitimate user revokes detected sessions. The fix implements optimistic locking on the authData login path, preventing concurrent database updates when the MFA token array has been altered by another request.

Recommendations Update to Parse Server version 8.6.64 or later. Update to Parse Server version 9.7.0-alpha.8 or later.

Exploit

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

BIT-PARSE-2026-34224

CVE-2026-34224

GHSA-W73W-G5XW-RWHF

Produtos afetados

Parse Server

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34224.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/pull/10326 · Correção
• https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf · Correção
• https://github.com/parse-community/parse-server/pull/10327 · Correção
• https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34224 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-34224 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004434148086043 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-w73w-g5xw-rwhf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34224 · Nota de Segurança