CVE-2021-41109: LiveQuery session token exposure in parse-server
Summary
CVE-2021-41109: LiveQuery publishes user session tokens in parse-server. Affects parse-server versions < 4.10.4. Fixed in 4.10.4. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2021-41109 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parse-server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a set of APIs and tools for managing data and user authentication. One of its features is LiveQuery, which enables real-time data synchronization between clients and the server. However, a vulnerability has been discovered in parse-server that exposes user session tokens when using LiveQuery.
Vulnerability Detail
The vulnerability in parse-server allows session tokens created during user sign-ups to be broadcasted as part of the LiveQuery payload. While regular queries remove the session token from the response, LiveQuery payloads do not. This means that if a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be exposed. This can potentially lead to unauthorized access and compromise of user accounts. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.10.4
This is the first release that contains the fix.
npm install parse-server@4.10.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up. This will prevent the session token from being exposed in the LiveQuery payload. However, this workaround should be considered temporary, and it is still recommended to apply the patch by upgrading to the latest version of parse-server.
Conclusion
The vulnerability in parse-server exposes user session tokens when using LiveQuery, potentially leading to unauthorized access and compromise of user accounts. It is recommended to apply the patch by upgrading to the latest version of parse-server (4.10.4 or later). As a temporary workaround, you can set user.acl(new Parse.ACL()) in a beforeSave trigger. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
parse-server is an open-source backend framework that provides APIs and tools for managing data and user authentication in applications.
LiveQuery is a feature in parse-server that enables real-time data synchronization between clients and the server.
The vulnerability exposes user session tokens created during sign-ups when using LiveQuery. These session tokens can be accessed by any user with a LiveQuery subscription on the Parse.User class.
The exposure of user session tokens can lead to unauthorized access and compromise of user accounts. Attackers could potentially use these tokens to impersonate users and perform malicious actions.
The vulnerability can be fixed by upgrading the parse-server package to version 4.10.4 or later. This version removes the session token from the LiveQuery payload.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
