Security Advisories · parse-community/parse-server · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

LiveQuery publishes user session tokens
GHSA-7pr3-p5fm-8r9x published Sep 30, 2021 by mtrezza

High
Incorrect version tags linked to external repository
GHSA-593v-wcqx-hq2w published Sep 3, 2021 by davimacedo

Critical
Session object properties can be updated by foreign user if object ID is known
GHSA-6w4q-23cf-j9jp published Sep 20, 2022 by mtrezza

Moderate
Authentication provider credentials are usable across Parse Server apps
GHSA-837q-jhwx-cmpv published Mar 21, 2025 by mtrezza

Moderate
Server crashes with invalid explain query parameter
GHSA-xqp8-w826-hh6x published Sep 2, 2021 by mtrezza

High
New anonymous user session acts as if it's created with password
GHSA-23r4-5mxp-c7g5 published Aug 18, 2021 by mtrezza

Moderate
Receiving subscription objects with deleted session
GHSA-2xm2-xj2q-qgpj published Oct 21, 2020 by davimacedo

Moderate
GraphQL: Security breach on Viewer query
GHSA-236h-rqv8-8q73 published Jul 22, 2020 by davimacedo

High
Regex Vulnerabilities
GHSA-h4mf-75hf-67w4 published Mar 3, 2020 by acinader

Critical
LDAP auth stores password in plain text
GHSA-4w46-w44m-3jq3 published Dec 2, 2020 by davimacedo

Low