Executive brief
Parse Server is a backend-as-a-service framework that handles user authentication and data management. An unauthenticated attacker can disable the service by sending rapid authentication requests with fake provider names, forcing the database to perform full table scans without index optimization. This can exhaust database resources and make the service unavailable to legitimate users.
Technical details
This vulnerability is a denial-of-service flaw in the authentication request handling logic. When a user attempts to authenticate with an unconfigured auth provider, the server queries the user database before validating whether that provider is configured, and because no index exists for unconfigured providers, each request triggers a full collection scan. An unauthenticated remote attacker can exploit this by sending many parallel requests with arbitrary provider names, saturating database I/O and CPU resources. The fix validates that an auth provider is configured before executing any database query. Affected versions are Parse Server <8.6.58 and 9.0.0–<9.6.0-alpha.52; patches are available.
Affected products
- Parse Community Parse Server <8.6.58 and >=9.0.0, <9.6.0-alpha.52
Timeline
- 2026-03-24: disclosed
- 2026-03-24: patched: Patches available: 8.6.58 and 9.6.0-alpha.52