NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · npm

CVE-2026-32248: Parse Server: Account takeover via operator injection in authentication data identifier

criticalCVSS 4.0 9.3GHSA-5fw2-8jcv-xh87

Impact An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session…

Published Mar 12, 2026 · Updated Mar 13, 2026

Affected packages

parse-server

Ecosystem
npm
Affected
>= 9.0.0, < 9.6.0-alpha.12
Fixed in
9.6.0-alpha.12
Check
npm ls parse-server

parse-server

Ecosystem
npm
Affected
< 8.6.38
Fixed in
8.6.38
Check
npm ls parse-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.

Patches

The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.

Workarounds

There is no known workaround.

References

  • GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87
  • Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
  • Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38

Credited to fancymalware, mtrezza.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries