CVE-2026-87806: Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Server built-in LDAP authentication adapterto a version that resolves this vulnerability.Fixed in 8.6.88 - Upgrade
Upgrade
Parse Server built-in LDAP authentication adapterto a version that resolves this vulnerability.Fixed in 9.10.1-alpha.7
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Only Parse Server deployments with the built-in LDAP authentication adapter enabled are affected. Exploitation also depends on the LDAP directory accepting an unauthenticated simple bind; Active Directory does so in its default configuration, while stock OpenLDAP configurations refuse it.
What does an attacker need to exploit the bypass?
An attacker does not need credentials, but must know a directory username for the target account. They submit that username with a zero-length password and can receive a valid session token if the directory returns success for the unauthenticated bind.
How can we tell whether our deployment may already be vulnerable?
Check whether the LDAP authentication adapter is enabled and whether the Parse Server version is at or below 8.6.87, or from 9.0.0 through before 9.10.1-alpha.7. Then determine whether the configured directory accepts unauthenticated simple binds, as default Active Directory configurations do.
What mitigation is available if an immediate upgrade is not possible?
Use an LDAP directory configuration that refuses unauthenticated simple binds, or disable the LDAP authentication adapter. The fixed releases reject empty passwords before contacting the directory.