GHSA-WP76-GG32-8258 Parse Server exposes auth data via verify password endpoint

🗓️ 29 Mar 2026 15:14:03Reported by GoogleType

osv🔗 osv.dev👁 13 Views

Parse Server verify password endpoint exposes MFA secrets and OAuth tokens; sanitized via auth adapter hooks.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-34215	31 Mar 202619:34	–	attackerkb
Circl	CVE-2026-34215	31 Mar 202621:19	–	circl
CNNVD	Parse Server 安全漏洞	31 Mar 202600:00	–	cnnvd
CVE	CVE-2026-34215	31 Mar 202619:34	–	cve
Cvelist	CVE-2026-34215 Parse Server: Auth data exposed via verify password endpoint	31 Mar 202619:34	–	cvelist
Github Security Blog	Parse Server exposes auth data via verify password endpoint	29 Mar 202615:14	–	github
NVD	CVE-2026-34215	31 Mar 202620:16	–	nvd
OSV	BIT-PARSE-2026-34215 Parse Server: Auth data exposed via verify password endpoint	6 Apr 202614:49	–	osv
Positive Technologies	PT-2026-28610	29 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-34215	1 Apr 202623:00	–	redhatcve

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34215
github	www.github.com/parse-community/parse-server/pull/10278
github	www.github.com/parse-community/parse-server/pull/10279
github	www.github.com/parse-community/parse-server/pull/10323
github	www.github.com/parse-community/parse-server/pull/10324
github	www.github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c
github	www.github.com/parse-community/parse-server/commit/770be8647424d92f5425c41fa81065ffbbb171ed
github	www.github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f
github	www.github.com/parse-community/parse-server/commit/a1d4e7b12a12f16d3870dbee582a36765858e94c

06 Apr 2026 15:27Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.2

EPSS0.00303