The vulnerability lies within the verify password endpoint of Parse Server: when a user’s credentials are validated, the endpoint returns unsanitized authentication data that includes MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who possesses a user’s password can extract the MFA secret and generate valid one‑time codes, thereby bypassing multi‑factor authentication and gaining unauthorized access to the account.

Parse Community’s Parse Server, which runs on Node.js, is affected. All versions released before 8.6.63 and before 9.7.0‑alpha.7 contain the vulnerability. This includes every prior minor and release candidate build of Parse Server.

The problem carries a high severity rating of 8.2, yet the estimated likelihood of exploitation is below 1%. It is not listed in the CISA KEV catalog. Attackers must first obtain a victim’s password through phishing, credential stuffing, or other means. Once authenticated, they can retrieve the MFA secret and use it to produce valid MFA codes, effectively undermining the second factor and compromising the target account.