PT-2026-26493 · Unknown · Parse Server

Restriction · Published 2026-03-19 · Updated 2026-03-27 · CVE-2026-33409

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.52 Parse Server versions prior to 9.6.0-alpha.41

Description A flaw exists in Parse Server that allows an attacker to bypass authentication and log in as any user who has linked a third-party authentication provider. The attacker requires only the user's provider ID to gain full access to the account, including a valid session token. This issue impacts deployments where the allowExpiredAuthDataToken server option is set to true. The vulnerable component is the authentication process, specifically when handling third-party authentication providers.

Recommendations Update Parse Server to version 8.6.52 or later. Update Parse Server to version 9.6.0-alpha.41 or later. Set the allowExpiredAuthDataToken server option to false. Remove the allowExpiredAuthDataToken option from the server configuration.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-PARSE-2026-33409

CVE-2026-33409

GHSA-PFJ7-WV7C-22PR

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33409.json · Exploit
• https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c · Patch
• https://osv.dev/vulnerability/BIT-parse-2026-33409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33409 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33409 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfj7-wv7c-22pr · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10247 · Note
• https://github.com/parse-community/parse-server/pull/10246 · Note
• https://github.com/parse-community/parse-server · Note
• https://reddit.com/r/VulnMatter/comments/1ryvfc9/resumen_diario_de_vulnerabilidades_20032026 · Reddit Post