Security Advisories · parse-community/parse-server · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Password reset token single-use bypass via concurrent requests
GHSA-r3xq-68wh-gwvh published Mar 16, 2026 by mtrezza

Low
Email verification resend page leaks user existence
GHSA-h29g-q5c2-9h4f published Mar 19, 2026 by mtrezza

Moderate
LiveQuery subscription with invalid regular expression crashes server
GHSA-827p-g5x5-h86c published Mar 16, 2026 by mtrezza

Moderate
GraphQL WebSocket endpoint bypasses security middleware
GHSA-p2x3-8689-cwpg published Mar 13, 2026 by mtrezza

Moderate
Cloud function dispatch crashes server via prototype chain traversal
GHSA-4263-jgmp-7pf4 published Mar 16, 2026 by mtrezza

High
OAuth2 adapter shares mutable state across providers via singleton instance
GHSA-2cjm-2gwv-m892 published Mar 11, 2026 by mtrezza

Critical
OAuth2 adapter app ID validation sends wrong token to introspection endpoint
GHSA-69xg-f649-w5g2 published Mar 12, 2026 by mtrezza

Moderate
Protected fields leak via LiveQuery afterEvent trigger
GHSA-5hmj-jcgp-6hff published Mar 17, 2026 by mtrezza

High
Account takeover via operator injection in authentication data identifier
GHSA-5fw2-8jcv-xh87 published Mar 11, 2026 by mtrezza

Critical
Session creation endpoint allows overwriting server-generated session fields
GHSA-5v7g-9h8f-8pgg published Mar 16, 2026 by mtrezza

Moderate