CVE-2026-33627

🗓️ 24 Mar 2026 18:31:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 18 Views🌐 WEB

Parse Server exposes unsanitized auth data via /users/me, leaking multifactor secrets; fixed in 8.6.61 and 9.6.0-alpha.55.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-33627	24 Mar 202618:31	–	attackerkb
CNNVD	Parse Server 信息泄露漏洞	24 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33627 Parse Server: Auth data exposed via /users/me endpoint	24 Mar 202618:31	–	cvelist
EUVD	EUVD-2026-14980	24 Mar 202620:17	–	euvd
Github Security Blog	Parse Server exposes auth data via /users/me endpoint	24 Mar 202620:17	–	github
NVD	CVE-2026-33627	24 Mar 202619:16	–	nvd
OSV	BIT-PARSE-2026-33627 Parse Server: Auth data exposed via /users/me endpoint	27 Mar 202607:14	–	osv
OSV	CVE-2026-33627 Parse Server: Auth data exposed via /users/me endpoint	24 Mar 202618:31	–	osv
OSV	GHSA-37MJ-C2WF-CX96 Parse Server exposes auth data via /users/me endpoint	24 Mar 202620:17	–	osv
Positive Technologies	PT-2026-27486	24 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.61node.js

parseplatform parse-serverRange9.0.0–9.6.0node.js

parseplatform parse-serverMatch9.6.0alpha1node.js

parseplatform parse-serverMatch9.6.0alpha10node.js

parseplatform parse-serverMatch9.6.0alpha11node.js

parseplatform parse-serverMatch9.6.0alpha12node.js

parseplatform parse-serverMatch9.6.0alpha13node.js

parseplatform parse-serverMatch9.6.0alpha14node.js

parseplatform parse-serverMatch9.6.0alpha15node.js

parseplatform parse-serverMatch9.6.0alpha16node.js

parseplatform parse-serverMatch9.6.0alpha17node.js

parseplatform parse-serverMatch9.6.0alpha18node.js

parseplatform parse-serverMatch9.6.0alpha19node.js

parseplatform parse-serverMatch9.6.0alpha2node.js

parseplatform parse-serverMatch9.6.0alpha20node.js

parseplatform parse-serverMatch9.6.0alpha21node.js

parseplatform parse-serverMatch9.6.0alpha22node.js

parseplatform parse-serverMatch9.6.0alpha23node.js

parseplatform parse-serverMatch9.6.0alpha24node.js

parseplatform parse-serverMatch9.6.0alpha25node.js

parseplatform parse-serverMatch9.6.0alpha26node.js

parseplatform parse-serverMatch9.6.0alpha27node.js

parseplatform parse-serverMatch9.6.0alpha28node.js

parseplatform parse-serverMatch9.6.0alpha29node.js

parseplatform parse-serverMatch9.6.0alpha3node.js

parseplatform parse-serverMatch9.6.0alpha30node.js

parseplatform parse-serverMatch9.6.0alpha31node.js

parseplatform parse-serverMatch9.6.0alpha32node.js

parseplatform parse-serverMatch9.6.0alpha33node.js

parseplatform parse-serverMatch9.6.0alpha34node.js

parseplatform parse-serverMatch9.6.0alpha35node.js

parseplatform parse-serverMatch9.6.0alpha36node.js

parseplatform parse-serverMatch9.6.0alpha37node.js

parseplatform parse-serverMatch9.6.0alpha38node.js

parseplatform parse-serverMatch9.6.0alpha39node.js

parseplatform parse-serverMatch9.6.0alpha4node.js

parseplatform parse-serverMatch9.6.0alpha40node.js

parseplatform parse-serverMatch9.6.0alpha41node.js

parseplatform parse-serverMatch9.6.0alpha42node.js

parseplatform parse-serverMatch9.6.0alpha43node.js

parseplatform parse-serverMatch9.6.0alpha44node.js

parseplatform parse-serverMatch9.6.0alpha45node.js

parseplatform parse-serverMatch9.6.0alpha46node.js

parseplatform parse-serverMatch9.6.0alpha47node.js

parseplatform parse-serverMatch9.6.0alpha48node.js

parseplatform parse-serverMatch9.6.0alpha49node.js

parseplatform parse-serverMatch9.6.0alpha5node.js

parseplatform parse-serverMatch9.6.0alpha50node.js

parseplatform parse-serverMatch9.6.0alpha51node.js

parseplatform parse-serverMatch9.6.0alpha52node.js

parseplatform parse-serverMatch9.6.0alpha53node.js

parseplatform parse-serverMatch9.6.0alpha54node.js

parseplatform parse-serverMatch9.6.0alpha6node.js

parseplatform parse-serverMatch9.6.0alpha7node.js

parseplatform parse-serverMatch9.6.0alpha8node.js

parseplatform parse-serverMatch9.6.0alpha9node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.61",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.6.0-alpha.55",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f
github	www.github.com/parse-community/parse-server/pull/10278
github	www.github.com/parse-community/parse-server/pull/10279
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-37mj-c2wf-cx96
github	www.github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c

Parameter	Position	Path	Description	CWE
X-Parse-Session-Token	header	/users/me	Authenticated user GET /users/me returns unsanitized auth data including sensitive credentials; master context leaks to user data exposing MFA secrets.	CWE-200

17 Jun 2026 10:37Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.5

CVSS 47.1

EPSS0.00378

SSVC

CWE-200