CVE-2026-32248 - Vulnerability Analysis

Overview

Parse Server < 9.6.0-alpha.12 and < 8.6.38 contains an authentication bypass caused by crafted login requests triggering pattern-matching queries instead of exact-match lookups, letting unauthenticated attackers take over user accounts with vulnerable authentication providers, exploit requires anonymous authentication enabled.

Severity & Score

Impact

Unauthenticated attackers can take over user accounts and obtain valid session tokens, leading to full account compromise.

Mitigation

Update to version 9.6.0-alpha.12, 8.6.38 or later.

References

• https://github.com/parse-community/parse-server/releases/tag/8.6.38
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 13, 2026

🔴 CVE-2026-32248 - Critical (9.8) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32248/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner