CVE-2026-33429

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.54 Parse Server versions prior to 9.6.0-alpha.43

Description Parse Server contains a flaw where an attacker can subscribe to LiveQuery using a watch parameter that targets a protected field. While the actual value of the protected field is removed from event payloads, the system reveals whether the field has been updated, creating a binary oracle. For boolean protected fields, the timing of these events can reveal the field’s value. The watch parameter is not validated against protected fields during subscription, allowing this information leakage. Master key connections are exempt from this issue.

Recommendations Update to Parse Server version 8.6.54 or later. Update to Parse Server version 9.6.0-alpha.43 or later.