Parse Server versions before 8.6.103 and from 9.0.0 up to but not including 9.10.5 contain an information disclosure vulnerability in the LiveQuery feature. The issue arises because the subscription hash omits constraints adjacent to a $or operator, causing distinct subscriptions to be grouped incorrectly. This allows authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.