CVE-2026-116161

Parse Server versions prior to 8.6.103 and 9.0.0 before 9.10.5-alpha.4 are vulnerable to an information disclosure vulnerability in the LiveQuery component. The root cause is that the subscription hash omits constraints (such as the _Session owner filter and beforeSubscribe constraints) when a $o...