Skip to content
Threat Feed
Subscribe

Tag

Parse-Server

4 briefs RSS
high advisory

Parse Server LiveQuery Protected Field Leak via Shared Mutable State

Parse Server versions before 8.6.65 and between 9.0.0 and 9.7.0-alpha.9 are vulnerable to a data leak where protected fields and authentication data can be exposed to unauthorized clients due to shared mutable objects across concurrent LiveQuery subscribers.

parse-server livequery data-leak cve-2026-34363
3r
high advisory

Parse Server /users/me Endpoint Exposes MFA Secrets

Parse Server versions before 8.6.61 and versions 9.0.0 to 9.6.0-alpha.55 expose sensitive MFA credentials via the `/users/me` endpoint, allowing authenticated users to extract TOTP secrets and recovery codes.

Parse Server parse-server credential-access mfa-bypass
2r 1t
high advisory

Parse Server Denial of Service via Unindexed Database Query

An unauthenticated attacker can cause a Denial of Service (DoS) by sending authentication requests with arbitrary, unconfigured provider names, leading to a full collection scan on the user database in vulnerable Parse Server versions.

Parse Server parse-server denial-of-service webserver
2r 1t
high advisory

Parse Server PostgreSQL Adapter SQL Injection Vulnerability

A SQL injection vulnerability in Parse Server's PostgreSQL adapter allows an attacker with master key access to execute arbitrary SQL statements via crafted field names in aggregate `$group` or `distinct` operations, leading to privilege escalation.

Parse Server sql-injection privilege-escalation parse-server
2r 1t