Vulnerability in Parse Server's LiveQuery Subscription Revealed by Timing Events

CVE-2026-33429

What is CVE-2026-33429?

In Parse Server, an open-source backend solution, a vulnerability exists in the LiveQuery system that allows an attacker to exploit update events related to protected fields. Attackers can subscribe to LiveQuery with a watch parameter targeting these fields. While event payloads are stripped of sensitive field values, the mere presence or absence of update events reveals whether the protected field has changed. This creates a binary oracle that can be exploited, especially for boolean protected fields, where the timing of these events can effectively disclose the field's value. This vulnerability has been addressed in versions 8.6.54 and 9.6.0-alpha.43.

References