CVE-2026-53725 is a vulnerability in parse-community's parse-server affecting versions >=9.8.0 and <9.9.1-alpha.5. When MFA is enabled and get access on the _User class is denied via Class-Level Permissions, the /login and /verifyPassword endpoints improperly expose sensitive user data. The endpoints attempt to re-fetch the user through access-controlled queries, but if denied, the server falls back to returning the raw database row. This fallback exposes raw authData fields including MFA TOTP secrets and recovery codes, as well as fields protected by protectedFields when protectedFieldsOwnerExempt is false. The /verifyPassword endpoint is the most critical vector, as it allows an attacker who knows a victim's password to retrieve MFA secrets without requiring a session or MFA token, effectively defeating the second factor authentication. The issue was fixed in version 9.9.1-alpha.5.

Sensitive user authentication data including MFA TOTP secrets and recovery codes can be exposed to unauthorized actors if they know a victim's username and password. This exposure can allow attackers to bypass multi-factor authentication protections, significantly weakening account security. The vulnerability affects the confidentiality of user credentials and MFA secrets.

A fix is available in parse-server version 9.9.1-alpha.5. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation guidance is provided by the vendor advisory. Patch status is not explicitly stated beyond the fixed version, so users should verify the upgrade and test accordingly.