Parse Server stores password in plain text

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.5.0
• Patched version(s): 4.5.0

References

• GHSA-4w46-w44m-3jq3
• www.npmjs.com
• CVE-2020-26288
• CWE-312
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Information disclosure in parse-server - CVE-2020-5251
• parse-server new anonymous user session acts as if it's created with password - CVE-2021-39138
• Parse Server exposes auth data via verify password endpoint - CVE-2026-34215
• parse-server: MFA SMS one-time password accepted twice under concurrent login - CVE-2026-43930

You might also like:

How do hackers hack websites?

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

parse-server