CVE-2026-34215Disclosure(parseplatform / parse-server)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. This issue has been patched in versions 8.6.63 and 9.7.0-alpha.7.

parseplatform CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

parse-server

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-01); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

parseplatform

Products

parse-server

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-01	2	Disclosure1General1
2026-04-05	1	Disclosure1

Full discourse3 posts

PulsePatch.io@pulsepatchio187d
Disclosure
`Parse Server` exposes authentication data via its `verify password endpoint`, leading to potential account compromise (CVE-2026-34215). Monitor for official updates. #ParseServer #infosec #APIsecurity https://www.pulsepatch.io/posts/cve-2026-34215-parse-server-auth-data-exposure
Post summary
The post highlights that Parse Server’s verify password endpoint exposes authentication data (CVE‑2026‑34215). No PoC, exploit, patch, or evidence of active exploitation is discussed, so stakeholders should await vendor guidance.
0000034
4 followersView on X
Infoflowcloud@infoflowcloud191d
General
🚨*CVE* CVE-2026-34215 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify passwor… https://www.cve.org/CVERecord?id=CVE-2026-34215 ----- Traducción: CVE-2026-34215 Par… http://infoflow.cloud`
Post summary
The tweet merely references CVE-2026-34215 and links to its CVE record, providing no actionable exploit, patch, or technical detail.
0000022
65 followersView on X
CVE@CVEnew191d
Disclosure
CVE-2026-34215 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify passwor… https://www.cve.org/CVERecord?id=CVE-2026-34215
Post summary
The post announces CVE-2026‑34215 affecting older Parse Server releases, indicating vulnerable versions but providing no further technical details, PoC, exploit, or mitigation information.
00000155
56.9K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	parseplatform	parse-server	-	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-
App	parseplatform	parse-server	9.7.0	node.js	-

Explore more

Back to dashboard parseplatform CVEs parse-server vulnerabilities