CVE-2026-87806 is an authentication bypass vulnerability in parse-community's parse-server LDAP authentication adapter. The adapter forwards client-supplied passwords to the LDAP directory without verifying that a password was provided. A zero-length password triggers an unauthenticated simple bind as per RFC 4513 section 5.1.2, which some LDAP directories, including Active Directory by default, accept as successful anonymous authentication. This allows an unauthenticated attacker who knows a directory username to obtain a valid session token and take over that account. The vulnerability affects parse-server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7. The issue is resolved in versions 8.6.88 and 9.10.1-alpha.7 by rejecting empty passwords before contacting the directory.

An unauthenticated attacker can bypass LDAP authentication in affected parse-server versions by submitting a zero-length password, which some LDAP directories accept as anonymous bind success. This enables the attacker to obtain valid session tokens for arbitrary directory usernames, resulting in account takeover. Only deployments using the LDAP authentication adapter and directories that accept unauthenticated simple binds (e.g., default Active Directory) are vulnerable. Deployments with directories refusing unauthenticated binds (e.g., stock OpenLDAP) are not exploitable.

Upgrade parse-server to version 8.6.88 or later, or 9.10.1-alpha.7 or later, where the LDAP authentication adapter requires a non-empty password and rejects requests with empty passwords before contacting the directory. If upgrading is not immediately possible, disable the LDAP authentication adapter or ensure the LDAP directory refuses unauthenticated simple binds to mitigate exploitation.