CVE-2026-53725: parse-server Exposes MFA Secrets via Denied User Access
Summary
CVE-2026-53725: Impact Apps that enable MFA and deny get on the _User class via Class-Level Permissions could expose sensitive user data through the /login and /verifyPassword endpoints. Affects parse-server versions >= 9.8.0, < 9.9.1-alpha.5. Fixed in 9.9.1-alpha.5. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-53725 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications quickly and efficiently. It provides features such as user authentication, data storage, and real-time notifications. However, a vulnerability has been identified in versions 9.8.0 and later, where sensitive user data can be exposed through specific endpoints when access to user data is restricted.
Vulnerability Detail
The vulnerability arises from the handling of requests to the '/login' and '/verifyPassword' endpoints in Parse Server. When access to the '_User' class is denied via Class-Level Permissions (CLP), the server attempts to re-fetch user data. If this re-fetch fails due to denied permissions, the server defaults to returning raw database rows, which can include sensitive information such as MFA TOTP secrets and recovery codes. This flaw allows attackers to exploit the endpoints with just a username and password, potentially compromising user accounts by bypassing multi-factor authentication.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.9.1-alpha.5
This is the first release that contains the fix.
npm install parse-server@9.9.1-alpha.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds that maintain the intended restrictions on '_User' get permissions. The best course of action is to upgrade to the patched version.
Conclusion
The vulnerability identified as CVE-2026-53725 in Parse Server poses a significant risk by exposing sensitive user data through improperly handled access permissions. It is essential for developers using affected versions to upgrade to the latest patched version to protect user information and maintain application security.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability can lead to the exposure of sensitive user data, including MFA secrets and recovery codes, potentially allowing unauthorized access to user accounts.
Only Parse Server versions 9.8.0 and later are affected by this vulnerability. Versions 8.x and earlier are not impacted.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
While there are no effective workarounds that preserve the intended permissions, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate the risk.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
