TI-2021-17948 Aliases CVE-2021-41109 GHSA-7pr3-p5fm-8r9x

LiveQuery publishes user session tokens

LOW 35CWE-200Published 2021-09-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.

Why it matters now

EPSS 0.01246 69th percentileScored 2026-11-07

Fix Fixed parse-server (parse-community): 4.10.4parse-server (npm): 4.10.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
parse-community	parse-server	before 4.10.4	4.10.4	Patch available	CNA
—	parse-server (npm)	before 4.10.4	4.10.4	Patch available	GHSA-7pr3-p5fm-8r9x

parse-server Vendorparse-community Affected before 4.10.4 Fixed in 4.10.4 Patch available CNA
parse-server (npm) Vendor— Affected before 4.10.4 Fixed in 4.10.4 Patch available GHSA-7pr3-p5fm-8r9x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:parseplatform:parse-server::::::node.js::*	before 4.10.4	Vulnerable	parse-community

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* Versions before 4.10.4 Vulnerable ·parse-community

Remediation

Fix · CNA parse-server (parse-community) Fixed in 4.10.4
Fix · GHSA-7pr3-p5fm-8r9x parse-server (npm) Fixed in 4.10.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41109
2026-10-03 Alias added: GHSA-7pr3-p5fm-8r9x

References

Patch 1

https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559

Advisory 3

Other 1

https://github.com/parse-community/parse-server

TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
TI-2023-18316 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVSS 3.1CRITICAL 9.8
TI-2026-23790 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter CVSS 4.0CRITICAL 9.9

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences