Skip to content
Log inStart free trial

GHSA-p2x3-8689-cwpg BIT-parse-2026-32594 CVE-2026-32594

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

High npm
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.36%
Chance of exploitation in the next 30 days. Higher than 30.16% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-306 Missing Authentication for Critical Function
Fix
9.6.0-alpha.14
Upgrade parse-server to this version or later

Description

Impact

Any Parse Server deployment that uses the GraphQL API is affected. The GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the WebSocket endpoint and execute GraphQL operations without providing a valid application or API key, access the GraphQL schema via introspection even when public introspection is disabled, and send arbitrarily complex queries that bypass configured complexity limits.

Patches

The unfinished GraphQL WebSocket subscription feature has been removed, including the createSubscriptions method and the subscriptions-transport-ws dependency. GraphQL subscriptions were never functional in Parse Server as the schema did not define any subscription types.

Workarounds

Block WebSocket upgrade requests to the GraphQL subscriptions path (by default /subscriptions) at the network level, for example using a reverse proxy or load balancer rule.

Affected versions

npm

PackageVulnerableFixed in
parse-server
>= 9.0.0, < 9.6.0-alpha.14
9.6.0-alpha.14
parse-server
< 8.6.40
8.6.40

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

parse-server npm → 9.6.0-alpha.14

npm
npm install parse-server@9.6.0-alpha.14
yarn
yarn add parse-server@9.6.0-alpha.14
pnpm
pnpm add parse-server@9.6.0-alpha.14

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
None
Availability (vulnerable system)
Low
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 7.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Weakness

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

How to prevent it
  • Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
  • Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
  • Architecture and Design: Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks. In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
  • Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
  • Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-r899-h629-j84r
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
Low Also affects parse-server
GHSA-97pr-9hgg-3p8r
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Low Also affects parse-server
GHSA-v8x7-r927-cc93
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
Low Also affects parse-server
GHSA-cgxm-vr2f-6fj8
parse-server: Denial of service via exponential-time processing of deeply nested query operators
High Also affects parse-server
GHSA-wmwx-jr2p-4j4r
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Medium Also affects parse-server
GHSA-75v4-m273-5j49
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Medium Also affects parse-server
GHSA-7wqv-xjf3-x35v
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
Low Also affects parse-server
GHSA-p84r-h6rx-f2xr
parse-server: Server option routeAllowList is bypassable through batch sub-requests
Medium Also affects parse-server
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor