Parse · Parse Server · CVE-2020-26288
**Name of the Vulnerable Software and Affected Versions**
Parse Server versions prior to 4.5.0
**Description**
The issue involves the storage of user passwords in cleartext for LDAP authentication. This occurs in Parse Server when user passwords are not stripped after authentication, leading to cleartext password storage. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
**Recommendations**
For versions prior to 4.5.0, update to version 4.5.0 or later, which fixes the issue by stripping passwords after authentication to prevent cleartext password storage. As a temporary workaround, consider restricting access to LDAP authentication until the update is applied.