Security: parse-community/parse-server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
LDAP injection via unsanitized user input in DN and group filter constructionGHSA-7m6r-fhh7-r47c published
Mar 10, 2026 by mtrezzaModerate -
User enumeration via email verification endpointGHSA-w54v-hf9p-8856 published
Mar 10, 2026 by mtrezzaModerate -
Parse Server OAuth2 authentication adapter account takeover via identity spoofingGHSA-fr88-w35c-r596 published
Mar 10, 2026 by mtrezzaHigh -
Parse Server session token exfiltration via `redirectClassNameForKey` query parameterGHSA-6r2j-cxgf-495f published
Mar 10, 2026 by mtrezzaCritical -
Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesGHSA-7xg7-rqf6-pw6c published
Mar 9, 2026 by mtrezzaHigh -
Parse Server role escalation and CLP bypass via direct `_Join` table writeGHSA-5f92-jrq3-28rc published
Mar 10, 2026 by mtrezzaCritical -
Rate limit bypass via batch request endpointGHSA-775h-3xrc-c228 published
Mar 10, 2026 by mtrezzaModerate -
Bypass of class-level permissions in LiveQueryGHSA-7ch5-98q2-7289 published
Mar 10, 2026 by mtrezzaHigh -
Stored cross-site scripting (XSS) via SVG file uploadGHSA-hcj7-6gxh-24ww published
Mar 10, 2026 by mtrezzaHigh -
Missing audience validation in Keycloak authentication adapterGHSA-48mh-j4p5-7j9v published
Mar 10, 2026 by mtrezzaHigh