CVE-2020-26288: Plain Text Password Storage in Parse Server
Summary
CVE-2020-26288: Parse Server stores password in plain text. Affects parse-server versions < 4.5.0. Fixed in 4.5.0. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2020-26288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides functionality for managing user authentication and data storage. The vulnerability in Parse Server versions prior to 4.5.0 involves the storage of user passwords in plain text, specifically for LDAP authentication. This means that the passwords are not properly encrypted or hashed, making them easily accessible to anyone with access to the database. This vulnerability poses a significant security risk as it exposes user credentials, potentially leading to unauthorized access and compromise of user accounts.
Vulnerability Detail
The vulnerability in Parse Server versions prior to 4.5.0 allows user passwords involved in LDAP authentication to be stored in plain text. This means that the passwords are not properly protected and can be easily read by anyone with access to the database. Attackers who gain access to the database can retrieve these passwords and potentially use them to gain unauthorized access to user accounts. The impact of this vulnerability is significant as it compromises the security of user credentials and can lead to unauthorized access, data breaches, and other malicious activities.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.0
This is the first release that contains the fix.
npm install parse-server@4.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update Parse Server to version 4.5.0 or later.
Conclusion
The vulnerability in Parse Server versions prior to 4.5.0, which involves the storage of user passwords in plain text, poses a significant security risk. It is crucial to update Parse Server to version 4.5.0 or later to address this vulnerability and protect user credentials. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides functionality for managing user authentication and data storage.
LDAP (Lightweight Directory Access Protocol) is a protocol used for accessing and maintaining distributed directory information services. It is commonly used for user authentication in enterprise environments.
Storing passwords in plain text means that they are not properly protected and can be easily read by anyone with access to the database. This exposes user credentials and can lead to unauthorized access, data breaches, and other malicious activities.
To mitigate the risk of this vulnerability, it is recommended to update Parse Server to version 4.5.0 or later. This version addresses the issue by stripping the password after authentication, preventing the storage of passwords in plain text.
There is no specific workaround provided for this vulnerability. The recommended solution is to update Parse Server to version 4.5.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.