BIT-parse-2026-33429
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-33429.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-parse-2026-33429
- Aliases
- Published
- 2026-03-27T07:14:28.266Z
- Modified
- 2026-03-27T08:56:10.791280Z
- Summary
- Parse Server: Protected field change detection oracle via LiveQuery watch parameter
- Details
-
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. This issue has been patched in versions 8.6.54 and 9.6.0
- Database specific
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*" ] }- References
-
- https://github.com/parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4b
- https://github.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67
- https://github.com/parse-community/parse-server/pull/10253
- https://github.com/parse-community/parse-server/pull/10254
- https://github.com/parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgm
- https://nvd.nist.gov/vuln/detail/CVE-2026-33429
Affected packages
Bitnami / parse
Package
- Name
- parse
- Purl
- pkg:bitnami/parse
Severity
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator