Junglewise Threat Intelligence

CVE-2026-33627: Parse Server sensitive auth data leak via /users/me endpoint

CVE-2026-33627 · Severity: medium · CVSS 4 · Published 2026-03-24

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Executive brief

Parse Server is a backend-as-a-service platform that provides user authentication and session management for applications. An authenticated user can call the /users/me endpoint to retrieve their profile information, but the endpoint improperly returns unsanitized authentication credentials including multi-factor authentication (MFA) secrets and recovery codes. An attacker who obtains a valid user session token can extract MFA secrets to bypass multi-factor authentication protections indefinitely.

Technical details

This is an information disclosure vulnerability (CWE-200) in Parse Server's /users/me endpoint. The vulnerable component improperly uses master-level authentication when querying session and user data, which leaks authentication credentials that should be sanitized by auth adapter security layers. The attack requires an authenticated user context (valid session token) and network access to the Parse Server instance. By calling GET /users/me with a valid session, an attacker can retrieve raw authData including MFA TOTP secrets and recovery codes that are normally restricted. This allows the attacker to generate valid TOTP codes indefinitely, effectively circumventing multi-factor authentication. The fix separates the session and user data queries, applying the caller's authentication context to ensure all security layers apply correctly. Patches are available in versions 9.6.0-alpha.55 and 8.6.61.

Affected products

  • Parse Community Parse Server 0 to 8.6.60; 9.0.0 to 9.6.0-alpha.54

Timeline

  • 2026-03-24: disclosed
  • 2026-03-22: patched

References