CVE-2026-53725
1 advisory.
npm/parse-server CVE-2026-53725: medium
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Action: Upgrade parse-server to 9.9.1-alpha.5 or later.
npm i parse-server@9.9.1-alpha.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.8.0 | 9.9.1-alpha.5 | - |
Fixed versions
| 9.9.1-alpha.5 |
Sources
- osv: GHSA-75v4-m273-5j49
- https://github.com/parse-community/parse-server/security/advisories/GHSA-75v4-m273-5j49
- https://nvd.nist.gov/vuln/detail/CVE-2026-53725
- https://github.com/parse-community/parse-server/pull/10492
- https://github.com/parse-community/parse-server
CVE-2026-53725 · published · modified · JSON