GHSA-qpc3-fg4j-8hgm Parse Server has a protected field change detection oracle via LiveQuery watch parameter

• npm parse-server: >= 9.0.0, < 9.6.0-alpha.43 → fixed in 9.6.0-alpha.43 • npm parse-server: < 8.6.54 → fixed in 8.6.54

Impact An attacker can subscribe to LiveQuery with a `watch` parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. Patches The `watch` parameter is now validated against protected fields at subscription time, mirroring the existing validation for the `where` clause. Subscriptions that include protected fields in `watch` are rejected with a permission error. Master key connections are exempt. Workarounds None.