CVE-2026-33409

npm/parse-server CVE-2026-33409: critical 9.1

Parse Server has an auth provider validation bypass on login via partial authData

Action: Upgrade parse-server to 8.6.52 or later.

npm i parse-server@9.6.0-alpha.41

npm i parse-server@8.6.52

Affected

Fixed versions

Sources

• osv: GHSA-pfj7-wv7c-22pr
• https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr
• https://nvd.nist.gov/vuln/detail/CVE-2026-33409
• https://github.com/parse-community/parse-server/pull/10246
• https://github.com/parse-community/parse-server/pull/10247
• https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c
• https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d
• https://github.com/parse-community/parse-server

CVE-2026-33409 · published 2026-03-19T21:32:10Z · modified 2026-03-30T14:06:59.948845Z · JSON