CVE-2026-33627: Parse Server: Auth data exposed via /users/me endpoint
Impact
An authenticated user calling GET /users/me receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely.
Patches
The /users/me endpoint now queries the session and user data separately, using the caller's authentication context for the user query so that all security layers apply correctly.
Workarounds
There is no known workaround.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.61 and 9.6.0-alpha.55, an authenticated user calling GET /users/me receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely. This issue has been patched in versions 8.6.61 and 9.6.0-alpha.55.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33627?
CVE-2026-33627 is classified as a high severity vulnerability due to the exposure of sensitive authentication data.
How do I fix CVE-2026-33627?
To mitigate CVE-2026-33627, update to parse-server version 8.6.61 or 9.6.0-alpha.55 or later.
What data is exposed in CVE-2026-33627?
CVE-2026-33627 exposes sensitive authentication data such as MFA TOTP secrets and recovery codes through the /users/me endpoint.
Who is impacted by CVE-2026-33627?
Authenticated users of parse-server version 8.6.61 or earlier and 9.0.0 to 9.6.0-alpha.55 may be impacted by CVE-2026-33627.
What is the exploit vector for CVE-2026-33627?
The exploit vector for CVE-2026-33627 is the unauthenticated access to the GET /users/me endpoint which reveals unsanitized authentication data.