GitHub Advisoryadvisory · npm
GHSA-37mj-c2wf-cx96 Parse Server exposes auth data via /users/me endpoint
HIGH
Official page ↗
- Aliases
- CVE-2026-33627
- Ecosystem
- npm
- Packages
- parse-server
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-200
- Reviewed
- 2026-03-24
Affected packages
• npm parse-server: >= 9.0.0, < 9.6.0-alpha.55 → fixed in 9.6.0-alpha.55
• npm parse-server: < 8.6.61 → fixed in 8.6.61
Description
Impact
An authenticated user calling `GET /users/me` receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely.
Patches
The `/users/me` endpoint now queries the session and user data separately, using the caller's authentication context for the user query so that all security layers apply correctly.
Workarounds
There is no known workaround.
Related
Alias · CVE (1)
- CVE-2026-33627 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-37mj-c2wf-cx96 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-33627 advisory
- https://github.com/parse-community/parse-server/pull/10278 web
- https://github.com/parse-community/parse-server/pull/10279 web
- https://github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c web
- https://github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f web
- https://github.com/parse-community/parse-server package