PT-2026-28613

🗓️ 29 Mar 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Token and MFA recovery code or one time password enable multiple sessions via concurrent login, defeating single use MFA; optimistic locking fixes this.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-34224	31 Mar 202614:25	–	attackerkb
Circl	CVE-2026-34224	31 Mar 202616:04	–	circl
CNNVD	Parse Server 安全漏洞	31 Mar 202600:00	–	cnnvd
CVE	CVE-2026-34224	31 Mar 202614:25	–	cve
Cvelist	CVE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests	31 Mar 202614:25	–	cvelist
Github Security Blog	Parse Server has an MFA single-use token bypass via concurrent authData login requests	29 Mar 202615:23	–	github
NVD	CVE-2026-34224	31 Mar 202615:16	–	nvd
OSV	BIT-PARSE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests	6 Apr 202614:49	–	osv
OSV	CVE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests	31 Mar 202614:25	–	osv
OSV	GHSA-W73W-G5XW-RWHF Parse Server has an MFA single-use token bypass via concurrent authData login requests	29 Mar 202615:23	–	osv

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf
osv	www.osv.dev/vulnerability/BIT-parse-2026-34224
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34224.json
github	www.github.com/parse-community/parse-server/pull/10327
osv	www.osv.dev/vulnerability/GHSA-w73w-g5xw-rwhf
github	www.github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92
github	www.github.com/parse-community/parse-server/commit/e7efbebba398ce6abe5b6b6fb9829c6ebe310fbf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34224
osv	www.osv.dev/vulnerability/CVE-2026-34224
twitter	www.twitter.com/CVEnew/status/2039004434148086043

06 Apr 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.4

CVSS 42.1

EPSS0.00019

SSVC