PT-2026-25058 · Bitnami+4 · Parse+1

Fancymalware · Published 2026-03-12 · Updated 2026-03-17 · CVE-2026-32248

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.12 and 8.6.38

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is susceptible to account takeover. An unauthenticated attacker can compromise user accounts created with authentication providers that do not validate user identifiers, such as those using anonymous authentication. By submitting a specially crafted login request, the attacker can manipulate the server into performing a pattern-matching query instead of an exact-match lookup. This allows the attacker to successfully match an existing user and obtain a valid session token, effectively gaining control of the user's account. Both MongoDB and PostgreSQL database backends are affected. The issue stems from insufficient input validation for authentication data, specifically the user identifier. The fix involves enforcing that the user identifier is a string before use in database queries, rejecting non-string values.

Recommendations Versions prior to 9.6.0-alpha.12 should be updated to 9.6.0-alpha.12 or later. Versions prior to 8.6.38 should be updated to 8.6.38 or later.

Exploit

Fix

Weakness Enumeration

CWE-943

Related Identifiers

BIT-PARSE-2026-32248

CVE-2026-32248

GHSA-5FW2-8JCV-XH87

Affected Products

Parse

Parse Server

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32248.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5fw2-8jcv-xh87 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32248 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-32248 · Vendor Advisory
• https://github.com/parse-community/parse-server/releases/tag/8.6.38 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/pulsepatchio/status/2033921906420686873 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032179572247032267 · Twitter Post
• https://twitter.com/CVEnew/status/2032230664787865604 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032536125471109271 · Twitter Post
• https://twitter.com/CCBalert/status/2032475131444937010 · Twitter Post
• https://t.me/CVEtracker/47285 · Telegram Post