Tóm tắt nhanh
- CVE-2026-33627 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng parse-server (parseplatform), parse-server.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.39%, cao hơn 33.4% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 9.6.0, 8.6.61, 9.6.0-alpha.55 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.61
| 9.6.08.6.61
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.55< 8.6.61
| 9.6.0-alpha.558.6.61
|
Mô tả
Impact
An authenticated user calling GET /users/me receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely.
Patches
The /users/me endpoint now queries the session and user data separately, using the caller's authentication context for the user query so that all security layers apply correctly.
Workarounds
There is no known workaround.
Mô tả của NVD
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.61 and 9.6.0-alpha.55, an authenticated user calling GET /users/me receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely. This issue has been patched in versions 8.6.61 and 9.6.0-alpha.55.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí