LiveQuery publishes user session tokens in parse-server

Description

For regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.10.4
• Patched version(s): 4.10.4

References

• GHSA-7pr3-p5fm-8r9x
• CVE-2021-41109
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• parse-server new anonymous user session acts as if it's created with password - CVE-2021-39138
• parse-server's session object properties can be updated by foreign user if object ID is known - CVE-2022-39225
• Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` - CVE-2026-39381
• Parse Server has a login timing side-channel reveals user existence - CVE-2026-39321

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

parse-server