CVE-2026-33042 json
Parse Server affected by empty authData bypassing credential requirement on signup
published 2026-03-17 7 mo ago modified 2026-09-08 2 mo ago also BIT-parse-2026-33042 , EUVD-2026-12993 , GHSA-wjqw-r9x4-j59v
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled. The fix in 9.6.0-alpha.29 and 8.6.49 ensures that empty or non-actionable `authData` is treated the same as absent `authData` for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provider data is present. As a workaround, use a Cloud Code `beforeSave` trigger on the `_User` class to reject signups where `authData` is empty and no username/password is provided.
Patch / fix
- npm parse-server 8.6.49, 9.6.0-alpha.29
- bitnami parse 8.6.49, 9.6.0
- parseplatform parse-server 8.6.49, 9.6.0-alpha.29
- parseplatform parse_server 8.6.49, 9.6.0-alpha.29
- github.com/parse-community/parse-server#10219 pull request
- github.com/parse-community/parse-server#10220 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | >=9.0.0, <9.6.0-alpha.29 <8.6.49 |
9.6.0-alpha.29 8.6.49 |
| bitnami | parse | <8.6.49 >=9.0.0, <9.6.0 |
8.6.49 9.6.0 |
Affected products
- parse-community parse-server
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/parse-community/parse-server/pull/10219
web, issue-tracking, report
-
github.com
/parse-community/parse-server/pull/10220
web, issue-tracking, report
-
github.com
/parse-community/parse-server/security/advisories/GHSA-wjqw-r9x4-j59v
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33042
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2026-33042
- GitHub Advisory GHSA-wjqw-r9x4-j59v
- NVD CVE-2026-33042
- OSV BIT-parse-2026-33042
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.