CVE-2026-34224

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.

• CWE-367

• https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92Patch
• https://github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbfPatch
• https://github.com/parse-community/parse-server/pull/10326Issue Tracking, Patch
• https://github.com/parse-community/parse-server/pull/10327Issue Tracking, Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhfPatch, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34218ClearanceKit intercepts file-system access events on macOS a…6.3
• CVE-2026-34219libp2p-rust is the official rust language Implementation of …5.9
• CVE-2026-3422U-Office Force developed by e-Excellence has a Insecure Dese…9.8
• CVE-2026-34220MikroORM is a TypeScript ORM for Node.js based on Data Mappe…9.8
• CVE-2026-34221MikroORM is a TypeScript ORM for Node.js based on Data Mappe…9.1
• CVE-2026-34222Open WebUI is a self-hosted artificial intelligence platform…7.7
• CVE-2026-34225Open WebUI is a self-hosted artificial intelligence platform…4.3
• CVE-2026-34226Happy DOM is a JavaScript implementation of a web browser wi…7.5
• CVE-2026-34227Sliver is a command and control framework that uses a custom…8.8
• CVE-2026-34228Emlog is an open source website building system. Prior to ve…6.5
• CVE-2026-34229Emlog is an open source website building system. Prior to ve…6.1
• CVE-2026-34230Rack is a modular Ruby web server interface. Prior to versio…7.5