Skip to content
Threat Feed
Subscribe

Product

Parse Server

4 briefs RSS
medium advisory

Parse Server Pre-authentication Denial of Service via Client Version Header

A denial-of-service vulnerability, CVE-2026-47138, exists in Parse Server due to inefficient regular expression handling of the client SDK version field in HTTP requests, allowing an unauthenticated attacker to exhaust server resources by sending a crafted request with a malicious `X-Parse-Client-Version` header or `_ClientVersion` body field.

parse-server denial-of-service regex-backtracking CVE-2026-47138
2r 1t
high advisory

Parse Server /users/me Endpoint Exposes MFA Secrets

Parse Server versions before 8.6.61 and versions 9.0.0 to 9.6.0-alpha.55 expose sensitive MFA credentials via the `/users/me` endpoint, allowing authenticated users to extract TOTP secrets and recovery codes.

Parse Server parse-server credential-access mfa-bypass
2r 1t
high advisory

Parse Server Denial of Service via Unindexed Database Query

An unauthenticated attacker can cause a Denial of Service (DoS) by sending authentication requests with arbitrary, unconfigured provider names, leading to a full collection scan on the user database in vulnerable Parse Server versions.

Parse Server parse-server denial-of-service webserver
2r 1t
high advisory

Parse Server PostgreSQL Adapter SQL Injection Vulnerability

A SQL injection vulnerability in Parse Server's PostgreSQL adapter allows an attacker with master key access to execute arbitrary SQL statements via crafted field names in aggregate `$group` or `distinct` operations, leading to privilege escalation.

Parse Server sql-injection privilege-escalation parse-server
2r 1t