`/login` and `/verifyPassword` endpoints in Parse Server allow an attacker to retrieve raw `authData` for a user, including MFA TOTP secrets and recovery codes, as well as fields hidden by protectedFields. The flaw occurs when the re‑fetch of the `_User` through the normal access‑control pipeline is denied and the server falls back to the raw database row. With only a username and password, an attacker could obtain the second‑factor data, effectively bypassing MFA. The exposed data is highly sensitive as it can be used to compromise accounts or gain administrative access.

This issue affects the open‑source Parse Server community edition (`parse-community:parse-server`). Versions from 9.8.0 up to, but not including, 9.9.1‑alpha.5 are vulnerable. All instances using MFA with a Class‑Level Permission that denies `get` on the `_User` class are at risk.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Exploitation would likely occur over the public network via the exposed HTTP endpoints, requiring the attacker to know or guess a user’s password. If available, the attacker could then retrieve MFA secrets and defeat the second authentication factor. This makes the vulnerability relevant for environments that rely on MFA for account protection.