# CVE-2025-68115: Parse Server cross-site scripting in password reset and email verification

Source: https://junglewise.ai/threats/cve-2025-68115-parse-server-cross-site-scripting-in-password-reset-and-email  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-68115 · Severity: medium · CVSS 6.1 · Published 2025-12-16

Parse Server is a backend-as-a-service platform that handles user authentication and account management for applications. A cross-site scripting (XSS) vulnerability in the password reset and email verification pages allows attackers to inject malicious scripts that execute in users' browsers when they visit these pages, potentially stealing session tokens, credentials, or sensitive information.

Technologies: [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-68115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68115 being exploited in the wild.

**How severe is CVE-2025-68115?** Medium severity, with a CVSS score of 6.1, published 16 December 2025.

**Which products and versions are affected?** parse-server (npm) SEMVER:introduced=0,fixed=8.6.1.

**Is there a fix for CVE-2025-68115?** Yes. parse-server (npm): upgrade to 8.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68115 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-68115?** Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- parse-server (npm): upgrade to 8.6.1 or later

  ```sh
  npm install parse-server@8.6.1
  ```


## Technical details

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages (CWE-79). The vulnerability stems from unescaped Mustache template variables that directly insert user-controlled values into the HTML output without proper sanitization. The attack vector is network-based with no privilege requirement and only requires passive user interaction (user clicks a link). An attacker can craft a malicious URL containing XSS payloads that execute in the context of the vulnerable pages when a user visits them. The vulnerability is fixed in versions 8.6.1 and 9.1.0-alpha.3 and later, with patches escaping user-controlled values before HTML insertion.

## Affected products

- Parse Community Parse Server before 8.6.1 and 9.0.0 before 9.1.0-alpha.3

## Identifiers

- CVE-2025-68115
- GHSA-jhgf-2h8h-ggxv

## Timeline

- 2025-12-16: disclosed
- 2025-12-16: patched: Patches released as versions 8.6.1 and 9.1.0-alpha.3

## References

- [https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv](https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv)

## Related threats

- [Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist](https://junglewise.ai/threats/duplicate-advisory-parse-server-vulnerable-to-stored-xss-via-malformed-00d8867c)
- [Parse Server stored XSS via malformed Content-Type bypass](https://junglewise.ai/threats/cve-2026-61448-parse-server-stored-xss-via-malformed-content-type-bypass)
- [Parse Server information disclosure in LiveQuery ACL transitions](https://junglewise.ai/threats/cve-2026-57481-parse-server-information-disclosure-in-livequery-acl-transitions)
- [Parse Community Parse Server denial of service via nested query operators](https://junglewise.ai/threats/cve-2026-57480-parse-community-parse-server-denial-of-service-via-nested-query)
- [Parse Server stored XSS via file upload extension bypass](https://junglewise.ai/threats/cve-2026-55778-parse-server-stored-xss-via-file-upload-extension-bypass)