CVE-2026-53725: parse-server Endpoints `/login` And `/verifyPassword` Disclose Vulnerability

MODERATE
Advisory Identifier: GHSA-75v4-m273-5j49
Share
CWE-200
Published
Advisory Summary

CVE-2026-53725 is a MODERATE endpoints `/login` and `/verifypassword` disclose vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting parse-server libraries in the npm ecosystem. The issue involves endpoints `/login` and `/verifypassword` disclose mfa secrets and protected fields when `_user` get is denied. Remediation is available by upgrading affected packages to version 9.9.1-alpha.5.

CVE-2026-53725 at a Glance

CVE Identifier CVE-2026-53725
GHSA Identifier GHSA-75v4-m273-5j49
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Product parse-server
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-53725

To remediate this vulnerability, upgrade all affected parse-server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

parse-server fixed: 9.9.1-alpha.5 
npm install parse-server@9.9.1-alpha.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls parse-server

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-53725, inspect your project dependencies using npm:

npm ls parse-server

Analyze the terminal output to locate any version of parse-server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 9.9.1-alpha.5), your application is affected.

Note: The npm ls parse-server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In parse-server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Apps that enable MFA and deny `get` on the `_User` class via Class-Level Permissions could expose sensitive user data through the `/login` and `/verifyPassword` endpoints. These endpoints re-fetch the user through the access-controlled query pipeline (CLP, `protectedFields`, auth-adapter sanitizers) before responding. When that re-fetch was denied by the `_User` `get` permission, the server fell back to the raw database row, exposing raw `authData` (including MFA TOTP secrets and recovery codes) and fields hidden by `protectedFields` (when `protectedFieldsOwnerExempt` is `false`). `/verifyPassword` is the most severe: with only a username and password (no session or MFA token), an attacker who knows a victim's password could retrieve their MFA secret and recovery codes, defeating the second factor. Only Parse Server 9.8.0 and later are affected; 8.x and earlier are not. Master and maintenance key requests are unaffected, as they bypass these controls by design. ### Patches On a denied re-fetch, `/login` and `/verifyPassword` no longer fall back to the raw row; they return only the user's identity (plus the session token for `/login`). Master and maintenance key callers still receive the full record. ### Workarounds None that preserve the intended `_User` `get` restriction. Upgrade to a patched version.

CVE-2026-53725 Affected parse-server Versions

1 component(s)
Fixed Versions:
9.9.1-alpha.5
Product / Package Ecosystem Affected Versions Fixed Version
parse-server
npm/parse-server
npm
≥ 9.8.0
< 9.9.1-alpha.5
9.9.1-alpha.5

References

GitHub Advisory / Wiki ADVISORY
https://github.com/parse-community/parse-server/security/advisories/GHSA-75v4-m273-5j49
NVD — CVE-2026-53725 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53725
parse-server Source Repository REPOSITORY
https://github.com/parse-community/parse-server/pull/10492
parse-server Source Repository REPOSITORY
https://github.com/parse-community/parse-server

Frequently Asked Questions

What is CVE-2026-53725?
CVE-2026-53725 is a security vulnerability in parse-server involving Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Which parse-server versions are affected?
Affected versions include releases prior to 9.9.1-alpha.5 across affected packages: parse-server.
What version fixes CVE-2026-53725?
Upgrading to 9.9.1-alpha.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is parse-server affected?
Yes, parse-server is affected in releases prior to 9.9.1-alpha.5. Upgrade your dependency to 9.9.1-alpha.5 or later.
What CWE is associated with CVE-2026-53725?
CVE-2026-53725 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).
How can I check npm dependencies for CVE-2026-53725?
Run the dependency tree command: 'npm ls parse-server'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-75v4-m273-5j49",
  "modified" : "2026-06-19T19:35:15Z",
  "published" : "2026-06-19T19:35:15Z",
  "aliases" : [ "CVE-2026-53725" ],
  "summary" : "parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied",
  "details" : "### Impact\n\nApps that enable MFA and deny `get` on the `_User` class via Class-Level Permissions could expose sensitive user data through the `/login` and `/verifyPassword` endpoints.\n\nThese endpoints re-fetch the user through the access-controlled query pipeline (CLP, `protectedFields`, auth-adapter sanitizers) before responding. When that re-fetch was denied by the `_User` `get` permission, the server fell back to the raw database row, exposing raw `authData` (including MFA TOTP secrets and recovery codes) and fields hidden by `protectedFields` (when `protectedFieldsOwnerExempt` is `false`).\n\n`/verifyPassword` is the most severe: with only a username and password (no session or MFA token), an attacker who knows a victim's password could retrieve their MFA secret and recovery codes, defeating the second factor.\n\nOnly Parse Server 9.8.0 and later are affected; 8.x and earlier are not. Master and maintenance key requests are unaffected, as they bypass these controls by design.\n\n### Patches\n\nOn a denied re-fetch, `/login` and `/verifyPassword` no longer fall back to the raw row; they return only the user's identity (plus the session token for `/login`). Master and maintenance key callers still receive the full record.\n\n### Workarounds\n\nNone that preserve the intended `_User` `get` restriction. Upgrade to a patched version.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "parse-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.8.0"
      }, {
        "fixed" : "9.9.1-alpha.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/parse-community/parse-server/security/advisories/GHSA-75v4-m273-5j49"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53725"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/parse-community/parse-server/pull/10492"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/parse-community/parse-server"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T19:35:15Z",
    "nvd_published_at" : "2026-06-12T19:16:30Z"
  }
}