CVE-2026-33409: Parse Server Authentication Bypass via Partial AuthData
Summary
CVE-2026-33409: Parse Server: Auth provider validation bypass on login via partial authData. Affects parse across 2 version ranges.
< 8.6.52
>= 9.0.0, < 9.6.0
Fixed in 8.6.52 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-33409 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications with a robust server-side infrastructure using Node.js. It provides features such as user authentication, data storage, and real-time notifications. However, certain configurations can expose vulnerabilities, such as the one described here, which allows unauthorized access to user accounts.
Vulnerability Detail
The vulnerability in Parse Server arises from an authentication bypass that allows attackers to log in as any user linked to a third-party authentication provider without needing the user's credentials. By simply knowing the user's provider ID, an attacker can gain full access to the account, including a valid session token. This issue primarily affects deployments where the 'allowExpiredAuthDataToken' server option is set to true, which is not the default setting. The vulnerability has been identified in versions prior to 8.6.52 and 9.6.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.528.6.52 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update your Parse Server, consider setting the 'allowExpiredAuthDataToken' option to false in your server configuration. This will help mitigate the risk of unauthorized access until you can apply the patch.
Conclusion
CVE-2026-33409 is a significant vulnerability in Parse Server that allows unauthorized access to user accounts through an authentication bypass. It is crucial for developers to update their Parse Server to the latest versions or implement workarounds to secure their applications against this threat.
See every vulnerability recorded for parse →
FAQ
CVE-2026-33409 is a vulnerability in Parse Server that allows an attacker to bypass authentication and log in as any user linked to a third-party provider.
If you are using a version prior to 8.6.52 or 9.6.0 and have the 'allowExpiredAuthDataToken' option set to true, your server is vulnerable.
An attacker can gain unauthorized access to user accounts, potentially leading to data breaches and loss of user trust.
Yes, you can use Vulert to monitor your application for this and other open-source vulnerabilities in real-time without needing to access the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability using just your manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
