Parse Server: Auth data exposed via verify password endpoint

Parse Server: Auth data exposed via /users/me endpoint

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server has a protected fields bypass via logical query operators

Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter

Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file

New anonymous user session acts as if it's created with password

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass…

Parse Server has Stored XSS via file upload of HTML-renderable file types

Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables

Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server MFA recovery codes not consumed after use

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server: Session field immutability bypass via falsy-value guard

Parse Server has stored cross-site scripting (XSS) via SVG file upload

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server: Email verification resend page leaks user existence

Parse Server affected by empty authData bypassing credential requirement on signup

Parse Server has user enumeration via email verification endpoint

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Parse Server: Malformed `$regex` query leaks database error details in API response

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query

parse-server before 3.6.0 allows account enumeration

Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server has a SQL injection via query field name when using PostgreSQL

Parse Server: MFA single-use token bypass via concurrent authData login requests

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Parse Server: Session update endpoint allows overwriting server-generated session fields

Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid