Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
Parse Server: Hackers can take over any user account
GHSA-5fw2-8jcv-xh87
CVE-2026-32248
Summary
Parse Server's default setting for anonymous user sign-ups leaves accounts open to takeover by hackers. This can happen if the server is not configured to check user names properly. To fix this, update to the latest version of Parse Server (version 9 or 8).
What to do
- Update parse-server to version 9.6.0-alpha.12.
- Update parse-server to version 8.6.38.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| – | parse-server | > 9.0.0 , <= 9.6.0-alpha.12 | 9.6.0-alpha.12 |
| – | parse-server | <= 8.6.38 | 8.6.38 |
| parseplatform | parse-server | <= 8.6.38 | – |
| parseplatform | parse-server | > 9.0.0 , <= 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
| parseplatform | parse-server | 9.6.0 | – |
Original title
Parse Server: Account takeover via operator injection in authentication data identifier
Original description
### Impact
An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.
### Patches
The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.
### Workarounds
There is no known workaround.
### References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38
An unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable.
### Patches
The fix enforces that the user identifier in authentication data is a string before using it in a database query. Non-string values are rejected with a validation error.
### Workarounds
There is no known workaround.
### References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.38
ghsa CVSS4.0
9.3
Vulnerability type
CWE-943
- https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8j...
- https://github.com/parse-community/parse-server/releases/tag/8.6.38
- https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12
- https://github.com/advisories/GHSA-5fw2-8jcv-xh87
- https://nvd.nist.gov/vuln/detail/CVE-2026-32248
Published: 12 Mar 2026 · Updated: 14 Mar 2026 · First seen: 12 Mar 2026