Executive brief
Parse Server is a backend-as-a-service platform that manages user authentication and data. An attacker can create authenticated user accounts without providing required credentials (username and password) by sending an empty authData object during signup, bypassing account security controls even when anonymous registration is disabled.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the user signup flow. When a user sends an empty authData object, Parse Server incorrectly treats it as valid authentication data and creates an authenticated session without validating the presence of a username/password or valid third-party auth provider data. The attack requires network access to the signup endpoint with no authentication or user interaction required. An attacker can create authenticated sessions without credentials, potentially gaining unauthorized access to application resources. Patches are available in versions 9.6.0-alpha.29 and 8.6.49.
Affected products
- Parse Community Parse Server < 8.6.49, >= 9.0.0 and < 9.6.0-alpha.29
Timeline
- 2026-03-17: disclosed
- 2026-03-17: patched: Patches released in versions 8.6.49 and 9.6.0-alpha.29