Parse Server
CVE-2026-32248
CRITICAL
GHSA-5fw2-8jcv-xh87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted login request
-
DeliveryTrigger pattern-matching query instead of exact match
-
ExploitMatch existing user account
-
ExecutionObtain valid session token
-
ImpactGain account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Parse Server versions before 9.6.0-alpha.12 and 8.6.38 with authentication providers that do not validate user identifier format (e.g., anonymous authentication enabled). No special conditions — remote unauthenticated exploitation against default configurations. |
| Impact | CVSS 9.8. |
| Exploit ScenarioDerived | Inject queries for data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Earlier versions of this analysis (1)
Query injection in Parse Server.
RemediationAI
Update.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-943.
Know when Parse Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable. This vulnerability is fixed in 9.6.0-alpha.12 and 8.6.38.
Executive ViewAI
A critical vulnerability in Parse Server allows unauthenticated attackers to hijack user accounts by exploiting weak authentication validation, affecting any deployment with anonymous authentication enabled (default configuration). This poses an immediate risk of unauthorized account access, data breach, and potential system compromise for organizations running vulnerable Parse Server instances.
Disable anonymous authentication in Parse Server configuration immediately if operationally feasible. Implement WAF rules to detect and block malformed authentication requests with non-string identifiers. Restrict network access to Parse Server instances using firewall rules and VPN/bastion hosts. Enable comprehensive audit logging for all authentication attempts and implement real-time alerting for anomalous login patterns. Segment Parse Server from critical systems. Monitor for account takeover indicators (unusual login locations, IP addresses, activity patterns). Prepare for immediate patch deployment upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Parse Server Authentication Flaws
View all 2More in Parse Server
View allParse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all
Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions.
parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popula
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Exploit-DB