CVE-2026-32248: Parse Server: Account takeover via operator injection in authentication data identifier
Impact
An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.
Patches
The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable. This vulnerability is fixed in 9.6.0-alpha.12 and 8.6.38.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32248?
CVE-2026-32248 has a high severity rating due to the ability of unauthenticated attackers to take over user accounts.
How do I fix CVE-2026-32248?
To fix CVE-2026-32248, upgrade to parse-server version 8.6.38 or version 9.6.0-alpha.12.
What kind of attacks are possible due to CVE-2026-32248?
CVE-2026-32248 allows attackers to exploit vulnerabilities in user identifier validation to take over any user account.
Which versions of parse-server are affected by CVE-2026-32248?
CVE-2026-32248 affects versions of parse-server prior to 8.6.38 and those between 9.0.0 and 9.6.0-alpha.12.
Is authentication provider format validation vulnerable in CVE-2026-32248?
Yes, CVE-2026-32248 highlights vulnerabilities in authentication providers that do not validate user identifier formats.