CVE-2026-33429

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. This issue has been patched in versions 8.6.54 and 9.6.0-alpha.43.

• CWE-203

• https://github.com/parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4bPatch
• https://github.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67Patch
• https://github.com/parse-community/parse-server/pull/10253Issue Tracking
• https://github.com/parse-community/parse-server/pull/10254Issue Tracking
• https://github.com/parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgmVendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33425Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-33426Discourse is an open-source discussion platform. Prior to ve…3.8
• CVE-2026-33427Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2026-33428Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-3343A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2026-33430Briefcase is a tool for converting a Python project into a s…7.3
• CVE-2026-33431Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…6.5
• CVE-2026-33432Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.1
• CVE-2026-33433Traefik is an HTTP reverse proxy and load balancer. Prior to…8.8
• CVE-2026-33434Wazuh is a free and open source platform used for threat pre…7.1