Security Advisories · parse-community/parse-server · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

GraphQL WebSocket endpoint bypasses security middleware
GHSA-p2x3-8689-cwpg published Mar 13, 2026 by mtrezza

Moderate
Cloud function dispatch crashes server via prototype chain traversal
GHSA-4263-jgmp-7pf4 published Mar 16, 2026 by mtrezza

High
OAuth2 adapter shares mutable state across providers via singleton instance
GHSA-2cjm-2gwv-m892 published Mar 11, 2026 by mtrezza

Critical
OAuth2 adapter app ID validation sends wrong token to introspection endpoint
GHSA-69xg-f649-w5g2 published Mar 12, 2026 by mtrezza

Moderate
Protected fields leak via LiveQuery afterEvent trigger
GHSA-5hmj-jcgp-6hff published Mar 17, 2026 by mtrezza

High
Account takeover via operator injection in authentication data identifier
GHSA-5fw2-8jcv-xh87 published Mar 11, 2026 by mtrezza

Critical
Session creation endpoint allows overwriting server-generated session fields
GHSA-5v7g-9h8f-8pgg published Mar 16, 2026 by mtrezza

Moderate
Schema poisoning via prototype pollution in deep copy
GHSA-9ccr-fpp6-78qf published Mar 16, 2026 by mtrezza

Moderate
Protected fields bypass via LiveQuery subscription WHERE clause
GHSA-j7mm-f4rv-6q6q published Mar 10, 2026 by mtrezza

Moderate
SQL injection via query field name when using PostgreSQL
GHSA-c442-97qw-j6c6 published Mar 11, 2026 by mtrezza

Moderate