Live › vulnerability › CVE-2026-116161
Go to dashboardParse Server's LiveQuery groups distinct subscriptions together when they use a $or query, because the subscription hash leaves out some constraints. An authenticated client can therefore receive other users' events, including session tokens that can be used to impersonate those users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Applications running Parse Server with LiveQuery enabled, where clients can open subscriptions that use $or queries. The exposure depends on the subscription path and on whether users share a subscription scope; deployments without LiveQuery are not affected. The sources do not say whether default configurations enable LiveQuery.
No product ranges from the sources yet.
npm ls parse-server and compare it to the fixed versions.8.6.103 or later on the 8.x line.9.10.5-alpha.4 or later on the 9.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.
This page as .md · .json · in your agent: get_signal("CVE-2026-116161")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.