Parse Server CVE-2025-68115

Exploitation requires an attacker-crafted link to Parse Server's password-reset or email-verification HTML pages (e.g. the choose_password / request_password_reset / resend_verification_email routes) with a malicious payload placed in the token, username, or locale query parameter, which the server reflects unescaped into the page. The Pages Router feature serving these HTML pages must be reachable (the patch tests configure pages.enableRouter). The decisive limiting factor is required user interaction (UI:P): because this is reflected, not stored, an attacker must socially engineer a victim into clicking the crafted URL - there is no persistent payload and no server-side compromise. Affected versions are < 8.6.1 and the 9.x pre-releases >= 9.0.0 and < 9.1.0-alpha.3; no workaround exists other than upgrading.

This is a moderate, not high-priority, issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) scores 5.3 (Medium), and the signals are internally consistent: a reflected XSS requires victim interaction (UI:P) - the attacker must lure a user into clicking a crafted link - which is the single largest factor capping real-world risk. EPSS is low at 0.22% (11th percentile), consistent with a reflected client-side flaw that cannot be mass-exploited server-side. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis; however, PR diff #9985 ships regression tests containing working XSS payloads ('"><script>alert("XSS")</script>', '<img src=x onerror=alert(1)>', '"><svg/onload=alert(1)>') against the token, username, and locale parameters, which effectively demonstrate exploitability even though they are tests rather than a standalone weaponized POC. Impact is limited (C:L/I:L) - reflected XSS in the browser context of a single tricked victim, not server compromise. No signals conflict. Net: a legitimate bug worth patching on a normal cadence, but not an emergency given the required user interaction, low EPSS, and absence of active exploitation.

An attacker crafts a malicious URL to a Parse Server password-reset or email-verification page with a JavaScript payload embedded in the token, username, or locale query parameter, then phishes a target into clicking it (e.g. a fake 'reset your password' email). When the victim loads the page, the unescaped Mustache variable renders the payload and the script executes in the victim's browser against the Parse Server origin. The patch's test suite confirms payloads like '<img src=x onerror=alert(1)>' fire before the fix, so exploitability is demonstrated, though no standalone public exploit is identified.