CVE-2026-33409: Parse Server: Auth provider validation bypass on login via partial authData
Impact
An authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token.
This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false.
Patches
Auth providers are now always validated on login, regardless of the allowExpiredAuthDataToken setting. The option allowExpiredAuthDataToken has been deprecated and will be removed in a future major version.
Workarounds
Set allowExpiredAuthDataToken to false (the default) or remove the option from the server configuration.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0-alpha.41.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33409?
CVE-2026-33409 is classified as a high severity vulnerability due to its ability to allow authentication bypass.
How do I fix CVE-2026-33409?
To fix CVE-2026-33409, upgrade to parse-server version 8.6.52 or 9.6.0-alpha.41.
What software is affected by CVE-2026-33409?
CVE-2026-33409 affects parse-server versions before 8.6.52 and between 9.0.0 and 9.6.0-alpha.41.
Can CVE-2026-33409 be exploited remotely?
Yes, CVE-2026-33409 can be exploited remotely by an attacker who knows the user's third-party provider ID.
What type of vulnerability is CVE-2026-33409?
CVE-2026-33409 is an authentication bypass vulnerability that compromises user accounts linked with third-party authentication providers.