Every CVE Search/ Get API key

CVE-2021-41109

LiveQuery publishes user session tokens

7.5 HighFix available

CVE-2021-41109 is a high vulnerability (CVSS 7.5) in Parse-community Parse-server, published September 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in parse-server 4.10.4.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.25%Up 0.4 points since Oct 1, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
CVE-2021-41109
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2021-2005 7.5

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
EUVD-2021-2005
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-7pr3-p5fm-8r9x 7.5

LiveQuery publishes user session tokens in parse-server

Impact

For regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload.

Patches

Remove session token from LiveQuery payload.

Workaround

Set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
GHSA-7pr3-p5fm-8r9x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 7.5

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
CVE-2021-41109
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
CVE-2021-41109
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-7pr3-p5fm-8r9x 7.5

LiveQuery publishes user session tokens in parse-server

Impact

For regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload.

Patches

Remove session token from LiveQuery payload.

Workaround

Set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
GHSA-7pr3-p5fm-8r9x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVBIT-parse-2021-41109 No score

LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Record
BIT-parse-2021-41109
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
parse-server
npm
 before 4.10.4
4.10.4
parse
Bitnami
 before 4.10.4
4.10.4

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open