{"id":"GHSA-pfj7-wv7c-22pr","summary":"Parse Server has an auth provider validation bypass on login via partial authData","details":"### Impact\n\nAn authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token.\n\nThis affects Parse Server deployments where the server option `allowExpiredAuthDataToken` is set to `true`. The default value is `false`.\n\n### Patches\n\nAuth providers are now always validated on login, regardless of the `allowExpiredAuthDataToken` setting. The option `allowExpiredAuthDataToken` has been deprecated and will be removed in a future major version.\n\n### Workarounds\n\nSet `allowExpiredAuthDataToken` to `false` (the default) or remove the option from the server configuration.","aliases":["BIT-parse-2026-33409","CVE-2026-33409"],"modified":"2026-03-30T14:06:59.948845Z","published":"2026-03-19T21:32:10Z","database_specific":{"github_reviewed_at":"2026-03-19T21:32:10Z","nvd_published_at":"2026-03-24T19:16:53Z","cwe_ids":["CWE-287"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33409"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/pull/10246"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/pull/10247"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"affected":[{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.6.0-alpha.41"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pfj7-wv7c-22pr/GHSA-pfj7-wv7c-22pr.json"}},{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.52"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pfj7-wv7c-22pr/GHSA-pfj7-wv7c-22pr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}