CVE-2026-33627: Parse Server Information Disclosure Flaw

CVE-2026-33627 Overview

CVE-2026-33627 is a sensitive data exposure vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure running Node.js. The vulnerability allows authenticated users to receive unsanitized authentication data when calling the GET /users/me endpoint, including sensitive credentials such as MFA TOTP secrets and recovery codes.

Critical Impact

An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely, effectively bypassing multi-factor authentication protection.

Affected Products

• Parse Server versions prior to 8.6.61
• Parse Server 9.6.0-alpha1 through 9.6.0-alpha54
• All Parse Server deployments running on Node.js with MFA enabled

Discovery Timeline

• 2026-03-24 - CVE-2026-33627 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33627

Vulnerability Analysis

This vulnerability represents an information disclosure flaw (CWE-200) where sensitive authentication data is exposed to authenticated users through an API endpoint that should return sanitized user information. The core issue stems from an improper privilege context being applied during query execution.

When a user calls the GET /users/me endpoint, the server internally processes the session query using master-level authentication. This elevated privilege context inappropriately propagates through to the user data response, bypassing the auth adapter sanitization mechanisms that would normally strip sensitive fields from the response.

The vulnerability enables extraction of MFA-related secrets including TOTP shared secrets and account recovery codes. With access to the TOTP secret, an attacker can generate valid time-based one-time passwords indefinitely, completely undermining the security benefits of multi-factor authentication.

Root Cause

The root cause lies in how the /users/me endpoint handles authentication context during session queries. The endpoint uses master-level authentication internally for session validation, but this elevated context leaks through to the subsequent user data retrieval, causing the auth adapter sanitization logic to be bypassed. This results in raw, unsanitized authentication data being included in the API response.

Attack Vector

The attack requires network access and a valid session token from an authenticated user. An attacker exploiting this vulnerability would:

1. Obtain a valid user session token (through session hijacking, XSS, or other means)
2. Make a request to the GET /users/me endpoint using the stolen session token
3. Extract MFA TOTP secrets and recovery codes from the unsanitized response
4. Use the extracted secrets to generate valid TOTP codes, bypassing MFA protection

The vulnerability is exploitable remotely over the network and requires low privilege (valid authenticated session). No user interaction is required beyond the initial session token acquisition.

Detection Methods for CVE-2026-33627

Indicators of Compromise

• Unusual or repeated requests to the /users/me endpoint from unexpected IP addresses or user agents
• Session tokens being used from geographic locations inconsistent with normal user behavior
• Successful MFA authentications from devices or locations not previously associated with the user account
• Audit log entries showing API responses containing auth data fields that should be sanitized

Detection Strategies

• Monitor Parse Server access logs for elevated request volumes to the /users/me endpoint
• Implement anomaly detection on session token usage patterns to identify potential token theft
• Review authentication logs for MFA codes being used from new or suspicious devices after /users/me queries
• Configure alerting for any API responses that include sensitive auth data fields in user queries

Monitoring Recommendations

• Enable verbose logging on the Parse Server /users/me endpoint to capture full request and response details
• Implement rate limiting on user profile endpoints to slow potential automated extraction attempts
• Set up alerts for session tokens being used across multiple IP addresses or geographic regions
• Regularly audit user authentication patterns for signs of credential compromise

How to Mitigate CVE-2026-33627

Immediate Actions Required

• Upgrade Parse Server to version 8.6.61 or 9.6.0-alpha.55 or later immediately
• Review access logs for potential exploitation of the /users/me endpoint
• Consider rotating MFA secrets for all users as a precautionary measure
• Implement additional session validation controls while applying patches

Patch Information

Parse Platform has released security patches addressing this vulnerability. The fixes are available in versions 8.6.61 for the stable branch and 9.6.0-alpha.55 for the alpha branch. The patches ensure that auth adapter sanitization is properly applied regardless of the internal authentication context used for session queries.

For detailed patch information, see the GitHub Security Advisory GHSA-37mj-c2wf-cx96. The relevant commits implementing the fix are available at:

• Commit 5b8998e
• Commit 875cf10

Workarounds

• If immediate patching is not possible, consider implementing a reverse proxy or API gateway that filters sensitive auth data fields from /users/me responses
• Temporarily disable MFA enrollment for new users until the patch can be applied
• Implement additional application-layer validation to strip sensitive fields before returning user data
• Monitor and restrict access to the /users/me endpoint to trusted network segments where feasible

# Upgrade Parse Server to patched version
npm update parse-server@8.6.61

# Or for alpha branch users
npm update parse-server@9.6.0-alpha.55

# Verify installed version
npm list parse-server