CVE-2026-33429: Parse Server has a protected field change detection oracle via LiveQuery watch parameter
(updated )
An attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value.
References
- github.com/advisories/GHSA-qpc3-fg4j-8hgm
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4b
- github.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67
- github.com/parse-community/parse-server/pull/10253
- github.com/parse-community/parse-server/pull/10254
- github.com/parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgm
- nvd.nist.gov/vuln/detail/CVE-2026-33429
Code Behaviors & Features
Detect and mitigate CVE-2026-33429 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →