PT-2026-28613 · Unknown · Parse Server

Offset · Published 2026-03-29 · Updated 2026-04-06 · CVE-2026-34224

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.64 Parse Server versions prior to 9.7.0-alpha.8

Description Parse Server is an open source backend deployable on Node.js infrastructure. An attacker with a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This bypasses the single-use restriction of MFA recovery codes and SMS one-time passwords, enabling session persistence even after the legitimate user revokes detected sessions. The fix implements optimistic locking on the authData login path, preventing concurrent database updates when the MFA token array has been altered by another request.

Recommendations Update to Parse Server version 8.6.64 or later. Update to Parse Server version 9.7.0-alpha.8 or later.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BIT-PARSE-2026-34224

CVE-2026-34224

GHSA-W73W-G5XW-RWHF

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34224.json · Exploit
• https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf · Patch
• https://github.com/parse-community/parse-server/pull/10326 · Patch
• https://github.com/parse-community/parse-server/pull/10327 · Patch
• https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w73w-g5xw-rwhf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34224 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-34224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34224 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2039004434148086043 · Twitter Post