CVE-2026-87806: Improper Authentication in parse-community parse-server
Affects parse-community parse-serverSource CVE Database V5
Not known to be exploited · CVSS 9.1 Critical : patch parse-community parse-server as a priority.
Data as of 10/24/2026, 17:08:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| parse-communityparse-server | Affected
| Fixed in
|
| parse-communityparse-server | Affected
| Fixed in
|
GitHub Actionsparse-community/parse-serverpkg:github/parse-community/parse-serverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade parse-server to version 8.6.88 or later, or 9.10.1-alpha.7 or later, where the LDAP authentication adapter requires a non-empty password and rejects requests with empty passwords before contacting the directory. If upgrading is not immediately possible, disable the LDAP authentication adapter or ensure the LDAP directory refuses unauthenticated simple binds to mitigate exploitation.
Description
Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory.
Impact
An unauthenticated attacker can bypass LDAP authentication in affected parse-server versions by submitting a zero-length password, which some LDAP directories accept as anonymous bind success. This enables the attacker to obtain valid session tokens for arbitrary directory usernames, resulting in account takeover. Only deployments using the LDAP authentication adapter and directories that accept unauthenticated simple binds (e.g., default Active Directory) are vulnerable. Deployments with directories refusing unauthenticated binds (e.g., stock OpenLDAP) are not exploitable.
Summary
CVE-2026-87806 is an authentication bypass vulnerability in parse-community's parse-server LDAP authentication adapter. The adapter forwards client-supplied passwords to the LDAP directory without verifying that a password was provided. A zero-length password triggers an unauthenticated simple bind as per RFC 4513 section 5.1.2, which some LDAP directories, including Active Directory by default, accept as successful anonymous authentication. This allows an unauthenticated attacker who knows a directory username to obtain a valid session token and take over that account. The vulnerability affects parse-server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7. The issue is resolved in versions 8.6.88 and 9.10.1-alpha.7 by rejecting empty passwords before contacting the directory.