CVE Explorer

CVE-2026-33409

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the ser

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5c5719df250721b5ea7dedeca6de6d9f12174fe712eceb49ce0523490d0e9cbe

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"parse-server","vendor":"parse-community","versions":[{"status":"affected","version":"< 8.6.52"},{"status":"affected","version":">= 9.0.0, < 9.6.0-alpha.41"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions

{"name":"https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/references/3

{"name":"https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/references/4

{"name":"https://github.com/parse-community/parse-server/pull/10246","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/pull/10246"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/references/1

{"name":"https://github.com/parse-community/parse-server/pull/10247","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/pull/10247"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/references/2

{"name":"https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:625341836d00dac5f4f4982f8f0ecc321e6a73b51fe82f087f0a1538789b3210 · sha256:73bc3946c1ea45d5… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer