Executive brief
Parse Server is a backend-as-a-service platform that can authenticate users via LDAP directories like Active Directory. A flaw in the LDAP adapter allows attackers to bypass authentication by submitting an empty password, which some directory servers treat as a valid anonymous login. An unauthenticated attacker who knows a username can gain full account access, leading to session hijacking and data compromise.
Technical details
The vulnerability is an authentication bypass in Parse Server's LDAP authentication adapter (CWE-287: Improper Authentication). The adapter fails to validate that a password was provided before forwarding credentials to the directory server, and incorrectly accepts any non-error response as successful authentication. An attacker can send a zero-length password, which converts an LDAP simple bind into the unauthenticated mechanism per RFC 4513 section 5.1.2—some directories, particularly Active Directory in default configuration, respond with success and map the connection to an anonymous or guest account. The attack requires network access to the Parse Server endpoint and knowledge of a valid directory username, but no prior authentication or user interaction. Only deployments with the LDAP adapter enabled are affected; those using directories that refuse unauthenticated bind (like stock OpenLDAP) are not exploitable. Patches are available in version 8.6.88 and 9.10.1-alpha.7, which enforce a non-empty password requirement before contacting the directory.
Affected products
- Parse Community Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7
Timeline
- 2026-09-09: disclosed: CVE-2026-87806 and GHSA-863r-39r9-vfcf disclosed
- 2026-08-25: patched: Fix released in versions 8.6.88 and 9.10.1-alpha.7