Executive brief
Parse Server is a popular backend-as-a-service platform that handles user authentication and data management for applications. An unauthenticated attacker can hijack any user account by exploiting a flaw in how the server validates login credentials, gaining full access to that account's data and session. This vulnerability is particularly dangerous because anonymous authentication is enabled by default, putting all default-configured Parse Server deployments at immediate risk of account compromise.
Technical details
This is an operator injection vulnerability (CWE-943) in Parse Server's authentication module where user identifiers from authentication data are insufficiently validated before use in database queries. When a user identifier is not validated as a string, an attacker can pass object-type data containing MongoDB or PostgreSQL operators, causing the server to execute pattern-matching queries instead of performing exact lookups. The vulnerability affects both MongoDB and PostgreSQL backends. An unauthenticated attacker with network access can exploit this by sending a specially crafted login request to any Parse Server instance with anonymous authentication enabled (default configuration). The attacker gains a valid session token for any existing user account, leading to complete account takeover. Patches are available in Parse Server 8.6.38 and 9.6.0-alpha.12, which enforce string-type validation for authentication identifiers before database queries.
Affected products
- Parse Community Parse Server < 8.6.38; >= 9.0.0, < 9.6.0-alpha.12
Timeline
- 2026-03-12: disclosed: GHSA-5fw2-8jcv-xh87 published
- 2026-03-11: patched: Parse Server 8.6.38 and 9.6.0-alpha.12 released with fix