Parse Server vulnerabilities

Parse Server prior to versions 8.6.66 and 9.7.0-alpha.10 does not respect the allowOrigin server option in the GraphQL API, unconditionally allowing cross-origin requests from any website. The REST API correctly enforces this restriction.

Parse Server before versions 8.6.65 and 9.7.0-alpha.9 has a LiveQuery vulnerability. When multiple clients subscribe to the same class, shared mutable objects modified by sensitive data filters can leak protected fields or authentication data to unauthorized clients. Also, afterEvent Cloud Code trigger modifications can leak to other subscribers.

In Parse Server before versions 8.6.64 and 9.7.0-alpha.8, an attacker with a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests to the authData endpoint. This defeats the single-use guarantee of MFA codes, allowing session persistence even after the legitimate user revokes detected sessions.

Parse Server before versions 8.6.1 and 9.1.0-alpha.3 has a Reflected Cross-Site Scripting (XSS) vulnerability in password reset and email verification HTML pages. The patch in versions 8.6.1 and 9.1.0-alpha.3 escapes user-controlled values.