CVE-2021-39138: parse-server - Incorrectly Created Anonymous User Session
Summary
CVE-2021-39138: parse-server new anonymous user session acts as if it's created with password. Affects parse-server versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2021-39138 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parse-server is an open-source backend framework that provides a scalable and customizable solution for building mobile and web applications. It offers various features such as user authentication, data storage, and push notifications. The framework allows developers to create and manage user sessions, including anonymous sessions for users who prefer not to provide personal information. However, a vulnerability in parse-server's REST API for signing up anonymous users leads to the incorrect creation of session data, specifically the authProvider field in the _Session class. This field incorrectly indicates that the anonymous user session was created with a password, potentially leading to misclassification and access control issues.
Vulnerability Detail
The vulnerability arises when developers rely on the createdWith field in the session data to differentiate between password-based user sessions and anonymous user sessions. Due to the incorrect value assigned to the authProvider field, the server mistakenly identifies the anonymous session as being created with a password. This can have implications for access control mechanisms that depend on the createdWith field. If developers utilize this field to provide different levels of access or functionality for password-based and anonymous users, the misclassification can result in unintended behavior and potential security risks. It is important to note that the server does not currently utilize the createdWith field for internal decision-making, so the vulnerability only affects those who directly rely on this field.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.2
This is the first release that contains the fix.
npm install parse-server@4.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrade to the patched version is not feasible, developers can implement a workaround by avoiding the use of the createdWith field to make decisions related to anonymous user sessions. Instead, alternative methods or attributes should be utilized to differentiate between password-based and anonymous sessions. By refraining from relying on the createdWith field, developers can mitigate the misclassification issue and reduce the potential impact of the vulnerability.
Conclusion
The vulnerability in parse-server's REST API for signing up anonymous users can lead to the incorrect classification of anonymous sessions as password-based. This misclassification can result in access control issues and potential security risks for applications that rely on the createdWith field. To mitigate this vulnerability, developers should upgrade to version 4.5.1 or later of parse-server. Alternatively, they can implement a workaround by avoiding direct reliance on the createdWith field for decision-making related to anonymous user sessions. For further support and assistance in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
This vulnerability affects parse-server applications that utilize the REST API for signing up anonymous users and rely on the createdWith field to differentiate between password-based and anonymous user sessions. If the createdWith field is used for access control or functionality decisions, the misclassification of anonymous sessions as password-based can lead to unintended behavior and potential security risks.
The impact of this vulnerability depends on how developers utilize the createdWith field. If the field is not used directly for decision-making, there may be no immediate impact. However, if the field is relied upon to provide different levels of access or functionality for password-based and anonymous users, the misclassification can result in incorrect access control and potential security vulnerabilities.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is always recommended to promptly address vulnerabilities to mitigate potential risks.
Yes, the CVSS score for this vulnerability is 4.8, indicating a moderate severity level. The score is based on the assessment of the vulnerability's impact, exploitability, and other factors.
Yes, a patch is available for this vulnerability. Developers should upgrade to version 4.5.1 or later of parse-server to apply the fix and ensure the correct handling of anonymous user sessions.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
