LoginSign Up
← Back to all sparks
P

Parse Server

INFRA · APIS
Velocity7.5

Open-source backend platform for mobile and web apps

parseplatform.org ↗

Parse Server's 9.10.1 alpha series has patched five separate GHSA security advisories in three weeks — auth, data, and field exposure all affected.

open-sourcebaassecurity-patchesself-hostedauth-vulnerabilities
◆Current state
Parse Server is in an active pre-release security hardening cycle for version 9.10.1, with five GitHub Security Advisory disclosures patched across its alpha series. The vulnerabilities span authentication bypass (LDAP empty password, unverified auth provider), unauthenticated data deletion via operator injection, and protected field disclosure through LiveQuery. The pace — multiple GHSA patches per week — suggests a systematic security audit running concurrent with alpha development rather than isolated bug reports.
◆Where it's heading
The concentration of security fixes in this alpha series signals that Parse Server's maintainers are treating 9.10.1 as a security-hardening release before resuming feature work. For teams self-hosting Parse Server, this makes upgrading to 9.10.1 stable a mandatory action once it ships, not an optional one. The open-source BaaS is likely to return to feature development after the stable release closes out this advisory cycle.
◆Prediction
9.10.1 stable will ship shortly after the alpha series stops producing GHSA patches; teams running 9.x in production should track the release closely given the severity of the auth vulnerabilities in this cycle.

◆Recent moves

  1. 1d ago

    Rate limit bypass via X-Forwarded-For header fixed

    Rate limit enforcement could be bypassed by setting X-Forwarded-For: 127.0.0.1 on servers with a permissive trustProxy configuration. The fifth security fix in this alpha series, reinforcing the pattern of systematic security hardening underway in 9.10.1.

    View source ↗
  2. 2d ago

    Unverified auth provider identity accepted on password login (GHSA)

    A code-based auth adapter flaw allowed an unverified auth provider identity to pass on a password login, creating an authentication gap. Part of the GHSA series that defines this alpha cycle.

    View source ↗
  3. 6d ago

    Unauthenticated deletion via operator injection in device tokens

    ⚡ SPARK

    An unauthenticated attacker could delete installation records by injecting operators into the device token deduplication path — no credentials required. This is the most exploitable class of vulnerability in this cycle and represents the kind of issue that forces immediate action from self-hosters.

    View source ↗
  4. 6d ago

    LiveQuery leaks protected fields to partially identified subscribers

    LiveQuery subscribers with incomplete identity resolution could receive protected field values they should not see. An information disclosure bug that compounds the trust concerns from this alpha cycle's broader security review.

    View source ↗
  5. 20d ago

    Account takeover via empty password in LDAP auth adapter

    ⚡ SPARK

    The LDAP auth adapter accepted an empty string as a valid password, enabling account takeover on any user with LDAP authentication enabled. A complete authentication bypass — the most trust-damaging vulnerability in this series.

    View source ↗
  6. 1mo ago

    Parse.Query.explain incorrectly triggers afterFind hooks on query plans

    Parse.Query.explain was incorrectly running afterFind triggers on query plan results rather than actual query output, causing unexpected side effects for developers using explain for query analysis. A correctness bug with no security implications.

    View source ↗