Executive brief
Parse Server is a backend-as-a-service platform that provides GraphQL APIs for applications. The GraphQL WebSocket subscriptions feature bypasses critical security controls, allowing unauthenticated attackers to execute queries, view the API schema, and send resource-intensive requests that would normally be blocked. This could lead to unauthorized data access and service disruption for applications relying on this platform.
Technical details
The vulnerability is an authentication bypass in Parse Server's GraphQL WebSocket endpoint for subscriptions. The GraphQL WebSocket endpoint fails to pass requests through the Express middleware chain responsible for enforcing authentication, introspection control, and query complexity limits. An attacker can connect to the WebSocket endpoint (default path: /subscriptions) without valid credentials, execute arbitrary GraphQL operations, dump the entire schema via introspection even when disabled, and submit complex queries exceeding configured limits. The vulnerability affects versions >=9.0.0 <9.6.0-alpha.14 and <8.6.40. The fix removes the unfinished subscription feature entirely, including the createSubscriptions method and subscriptions-transport-ws dependency.
Affected products
- Parse Community Parse Server >=9.0.0 <9.6.0-alpha.14 and all versions <8.6.40
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Parse Server 9.6.0-alpha.14 and 8.6.40