CVE-2026-33409 - Vulnerability Analysis
CriticalCVSS: 9.1Last Updated: March 25, 2026
Parse Server - Authentication Bypass
Published: March 24, 2026Updated: March 25, 2026Remote Exploitable
Overview
Parse Server < 8.6.52 and < 9.6.0-alpha.41 contains an authentication bypass caused by improper validation of third-party authentication provider IDs when allowExpiredAuthDataToken is true, letting attackers log in as any linked user without credentials.
Severity & Score
Severity: Critical
CVSS Score: 9.1
Impact
Attackers can fully access any linked user account, including obtaining valid session tokens, leading to complete account compromise.
Mitigation
Update to versions 8.6.52 or 9.6.0-alpha.41 or later.
References
- https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c
- https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d
- https://github.com/parse-community/parse-server/pull/10246
- https://github.com/parse-community/parse-server/pull/10247
- https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr
Related Resources
Details
- CVE ID
- CVE-2026-33409
- Severity
- Critical
- CVSS Score
- 9.1
- Type
- broken_authentication
- Status
- confirmed
CWE
- CWE-287
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N