CVE-2026-33409: Parse Server has an auth provider validation bypass on login via partial authData
(updated )
An authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user’s credentials. The attacker only needs to know the user’s provider ID to gain full access to their account, including a valid session token.
This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false.
References
- github.com/advisories/GHSA-pfj7-wv7c-22pr
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c
- github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d
- github.com/parse-community/parse-server/pull/10246
- github.com/parse-community/parse-server/pull/10247
- github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr
- nvd.nist.gov/vuln/detail/CVE-2026-33409
Code Behaviors & Features
Detect and mitigate CVE-2026-33409 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →