CVE-2026-53725: Parse Server Exposes MFA Secrets and Protected Fields via Denied User Access
Summary
CVE-2026-53725: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Affects parse versions >= 9.8.0, < 9.9.1. Fixed in 9.9.1. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-53725 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build applications with a robust server-side infrastructure. It supports various features such as user authentication, data storage, and real-time notifications. The framework is designed to be deployed on any infrastructure that supports Node.js, making it versatile and widely used. However, certain configurations, particularly related to Multi-Factor Authentication (MFA) and Class-Level Permissions (CLP), can lead to vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability arises in Parse Server versions 9.8.0 to before 9.9.1, where applications enabling MFA and denying access to the _User class can inadvertently expose sensitive user data. Specifically, when the /login and /verifyPassword endpoints are accessed, the server attempts to re-fetch user data through an access-controlled query pipeline. If this re-fetch is denied due to CLP settings, the server defaults to returning raw database rows. This exposes critical information, including MFA TOTP secrets and recovery codes, as well as fields that should be protected. The /verifyPassword endpoint is particularly concerning, as it allows an attacker with a victim's username and password to retrieve MFA secrets, undermining the security provided by the second factor of authentication.
How To Fix
Minimum fixed version
9.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling MFA or adjusting Class-Level Permissions to prevent unauthorized access to sensitive user data until the update can be applied. However, this is not a long-term solution and should be addressed promptly with the patch.
Conclusion
CVE-2026-53725 highlights a significant vulnerability in Parse Server that can expose sensitive user data due to misconfigured permissions. It is crucial for developers using this framework to update to the patched version and to be aware of the potential risks associated with MFA and user permissions. Regular monitoring for vulnerabilities, such as through tools like Vulert, can help maintain application security.
See every vulnerability recorded for parse →
FAQ
CVE-2026-53725 is a vulnerability in Parse Server that allows unauthorized access to sensitive user data, including MFA secrets, when certain permissions are denied.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The primary risk is that attackers can gain access to MFA secrets and recovery codes, which can compromise user accounts and bypass two-factor authentication.
Yes, the vulnerability has been patched in Parse Server version 9.9.1. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, consider disabling MFA or adjusting Class-Level Permissions to limit access to sensitive data until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
