Executive brief
Parse Server is a backend-as-a-service platform that handles user authentication and account management for applications. A cross-site scripting (XSS) vulnerability in the password reset and email verification pages allows attackers to inject malicious scripts that execute in users' browsers when they visit these pages, potentially stealing session tokens, credentials, or sensitive information.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages (CWE-79). The vulnerability stems from unescaped Mustache template variables that directly insert user-controlled values into the HTML output without proper sanitization. The attack vector is network-based with no privilege requirement and only requires passive user interaction (user clicks a link). An attacker can craft a malicious URL containing XSS payloads that execute in the context of the vulnerable pages when a user visits them. The vulnerability is fixed in versions 8.6.1 and 9.1.0-alpha.3 and later, with patches escaping user-controlled values before HTML insertion.
Affected products
- Parse Community Parse Server before 8.6.1 and 9.0.0 before 9.1.0-alpha.3
Timeline
- 2025-12-16: disclosed
- 2025-12-16: patched: Patches released as versions 8.6.1 and 9.1.0-alpha.3