PT-2026-25999 · Unknown · Parse Server

Fancymalware · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-33042

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.29 Parse Server versions prior to 8.6.49

Description Parse Server is an open source backend deployable on Node.js infrastructures. A user can create an account without providing credentials by submitting an empty authData object, circumventing the username and password requirement. This allows the creation of authenticated sessions without valid credentials, even when anonymous users are disabled. The issue arises because empty or non-actionable authData was not treated the same as absent authData during credential validation for new user creation. The User class is involved in this process.

Recommendations Versions prior to 9.6.0-alpha.29 should be updated. Versions prior to 8.6.49 should be updated. As a workaround, implement a Cloud Code beforeSave trigger on the User class to reject signups where authData is empty and no username/password is provided.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-PARSE-2026-33042

CVE-2026-33042

GHSA-WJQW-R9X4-J59V

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33042.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-wjqw-r9x4-j59v · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-33042 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjqw-r9x4-j59v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33042 · Security Note
• https://github.com/parse-community/parse-server/pull/10220 · Note
• https://github.com/parse-community/parse-server/pull/10219 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2034520412671852662 · Twitter Post