← Back to the live CVE advisory feed

CVE-2026-87806: parse-server

Severity

9.1 (CRITICAL)

Vendor

PARSE-COMMUNITY

Affected versions

9.0.0 through before 9.10.1-alpha.7; 0 through before 8.6.88

Fixed version

9.10.1-alpha.7

Patch status

Patched

Published

2026-09-09T12:17:15.190

Modified

2026-09-09T13:20:44.643

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Parse Server versions = 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory.

View the official NVD record for CVE-2026-87806

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.