@openinc/parse-server-opendash (>=4.0.0, <=4.0.11) potentially affected by CVE-2026-39381 via parse-server (>=9.6.0-alpha.37, <=9.7.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.11 Source cves: CVE-2026-39381 Source advisory: OSV:GHSA-G4V2-QX3Q-4P64...

parse-server-otp-auth-adapter (>=1.0.0, <=1.0.1), parse-server-siwe-auth-adapter (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-39381 via parse-server (7.5.4)

parse-server NPM version 7.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - parse-server-otp-auth-adapter =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-39381 Source advisory: OSV:GHSA-G4V2-QX3Q-4P64...

parse-server-otp-auth-adapter (>=1.0.0, <=1.0.1), parse-server-siwe-auth-adapter (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-39381 via parse-server (7.5.4)

parse-server NPM version 7.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - parse-server-otp-auth-adapter =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-39381 Source advisory: SNYK:JS-PARSESERVER-15928862...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.11) potentially affected by CVE-2026-39381 via parse-server (>=9.6.0-alpha.37, <=9.7.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.11 Source cves: CVE-2026-39381 Source advisory: SNYK:JS-PARSESERVER-15928862...

CVE-2026-39381

Parse Server (open-source Node.js backend) has a vulnerability in the GET /sessions/me endpoint where protected _Session fields configured via protectedFields are exposed to any authenticated user. The issue occurs prior to versions 9.8.0-alpha.7 and 8.6.75; the equivalent GET /sessions and GET /...

CVE-2026-39381 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any...