Parse-Server

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Mar 10, 2026

Parse Server role escalation and CLP bypass via direct `_Join` table write

Mar 10, 2026

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

Mar 10, 2026

Parse Server has a protected fields bypass via logical query operators

Mar 10, 2026

Parse Server is missing audience validation in Keycloak authentication adapter

Mar 10, 2026

Parse Server has stored cross-site scripting (XSS) via SVG file upload

Mar 10, 2026

Parse Server ha a bypass of class-level permissions in LiveQuery

Mar 10, 2026

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Mar 10, 2026

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Mar 10, 2026

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Mar 10, 2026

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Mar 10, 2026

Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Mar 9, 2026

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Mar 7, 2026

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Mar 7, 2026

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Mar 7, 2026

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Mar 7, 2026

Parse Server: Malformed `$regex` query leaks database error details in API response

Mar 6, 2026

Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Mar 6, 2026

Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Mar 6, 2026

Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

Mar 6, 2026

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Feb 25, 2026

Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter

Dec 16, 2025

Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables

Dec 16, 2025

Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

Dec 12, 2025

Parse Server's custom object ID allows to acquire role privileges

Oct 4, 2024