Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.
References (3)
Core 3
Core References
Mitigation, Third Party Advisory x_refsource_confirm
https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x
Patch, Third Party Advisory x_refsource_misc
https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/parse-community/parse-server/releases/tag/4.10.4
Scores
CVSS v3
7.5
EPSS
0.0121
EPSS Percentile
64.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (2)
npm/parse-server
0 - 4.10.4npm
parseplatform/parse-server
< 4.10.4
Published
Sep 30, 2021
Tracked Since
Feb 18, 2026