CVE-2026-34224

npm/parse-server CVE-2026-34224: low

Parse Server has an MFA single-use token bypass via concurrent authData login requests

Action: Upgrade parse-server to 8.6.64 or later.

npm i parse-server@9.7.0-alpha.8

npm i parse-server@8.6.64

Affected

Fixed versions

Sources

• osv: GHSA-w73w-g5xw-rwhf
• https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf
• https://nvd.nist.gov/vuln/detail/CVE-2026-34224
• https://github.com/parse-community/parse-server/pull/10326
• https://github.com/parse-community/parse-server/pull/10327
• https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92
• https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf
• https://github.com/parse-community/parse-server

CVE-2026-34224 · published 2026-03-29T15:23:03Z · modified 2026-04-06T15:27:04.154437127Z · JSON