Parse Server EUVD-2026-74832

Exploitation requires that the target Parse Server deployment has the built-in LDAP authentication adapter enabled AND that the back-end directory accepts RFC 4513 unauthenticated simple binds (Active Directory in its default configuration does; a stock OpenLDAP configuration refuses them and is therefore not exploitable). The attacker must also know a valid directory username for the account being targeted. There is no requirement for a password, prior authentication, or user interaction (PR:N/UI:N), but the dependency on the directory's bind behavior is the key limiting factor - deployments not using the LDAP adapter are wholly unaffected.

The CVSS 4.0 base score of 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) reflects network-reachable, unauthenticated exploitation with high confidentiality and integrity impact but no availability impact, and the AT:P (attack requirement present) metric correctly captures that success depends on the back-end directory accepting unauthenticated simple binds. This is a genuine high priority for any Parse Server deployment that has enabled the LDAP adapter against Active Directory in its default posture, where exploitation reduces to knowing a username. The real-world blast radius is bounded, however: deployments that do not use the LDAP adapter are entirely unaffected, and deployments backed by a directory that refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable, so raw score alone overstates universal risk. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS figure was provided, meaning current signals point to a serious but not yet actively-exploited weakness that operators of AD-integrated instances should patch promptly.

An attacker who has enumerated or guessed a valid directory username (e.g., from email addresses) submits a Parse Server login request for that user with an empty password. The LDAP adapter issues an unauthenticated simple bind that Active Directory answers with success, and Parse Server returns a valid session token, giving the attacker full control of the victim's account. No public exploit code was identified at time of analysis, though the technique is straightforward to reproduce.