CVE-2026-33042: Parse Server Auth Bypass Vulnerability

CVE-2026-33042 Overview

CVE-2026-33042 is an authentication bypass vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js. The vulnerability allows users to sign up without providing credentials by sending an empty authData object, effectively bypassing the username and password requirement. This creates authenticated sessions without proper credentials, even when anonymous users are explicitly disabled in the server configuration.

Critical Impact

Attackers can create authenticated user accounts without valid credentials, potentially gaining unauthorized access to Parse Server applications and their associated data.

Affected Products

• Parse Server versions prior to 8.6.49
• Parse Server versions 9.6.0-alpha1 through 9.6.0-alpha28
• All Parse Server deployments running on Node.js with vulnerable versions

Discovery Timeline

• 2026-03-18 - CVE-2026-33042 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33042

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) exists in Parse Server's user registration logic. The flaw occurs because the server fails to properly validate the authData field during user signup requests. When a user submits a signup request with an empty authData object ({}), the server incorrectly treats this as valid authentication provider data, allowing account creation without requiring traditional username and password credentials.

The vulnerability is particularly concerning because it bypasses security controls even when anonymous user functionality is disabled. Administrators who have explicitly configured their Parse Server instances to require authenticated users may incorrectly assume their systems are protected against unauthorized account creation.

Root Cause

The root cause lies in insufficient validation of the authData object during new user creation. The server's credential validation logic did not treat empty or non-actionable authData the same as absent authData. This inconsistency allowed attackers to satisfy the authentication check by providing an empty object, circumventing the requirement for valid credentials or authentication provider data.

Attack Vector

This vulnerability is exploitable over the network without requiring prior authentication or user interaction. An attacker can craft a malicious HTTP request to the Parse Server's user signup endpoint, including an empty authData field in the request body. The server processes this request as a legitimate signup with authentication provider data, creating a new user account with an authenticated session.

The attack is straightforward to execute: by sending a POST request to the /users endpoint with {"authData": {}} in the body, an attacker bypasses the normal credential requirements. This can be leveraged to create numerous unauthorized accounts, potentially leading to resource exhaustion, data manipulation, or as a stepping stone for further attacks against the application.

Detection Methods for CVE-2026-33042

Indicators of Compromise

• User accounts created without username or password fields populated in the _User collection
• Unusual patterns of user registrations with empty or null authentication data
• MongoDB or database logs showing user creation operations with empty authData objects
• Authentication logs indicating sessions created without corresponding credential validation

Detection Strategies

• Implement monitoring for signup requests containing authData fields with empty objects
• Query the _User collection for accounts lacking both username/password and valid third-party authentication data
• Review Parse Server access logs for POST requests to /users or /parse/users endpoints with suspicious payloads
• Set up alerts for unusual spikes in user account creation activity

Monitoring Recommendations

• Enable detailed logging for all user registration events in Parse Server
• Monitor network traffic for requests to user signup endpoints containing empty JSON objects
• Implement database auditing to track changes to the _User collection
• Configure SIEM rules to detect authentication bypass patterns

How to Mitigate CVE-2026-33042

Immediate Actions Required

• Upgrade Parse Server to version 8.6.49 or 9.6.0-alpha.29 immediately
• Audit existing user accounts in the _User collection for potentially unauthorized accounts created via this vulnerability
• Implement the Cloud Code workaround if immediate patching is not possible
• Review application access logs for signs of exploitation

Patch Information

The Parse Server maintainers have released patches addressing this vulnerability. The fix ensures that empty or non-actionable authData is treated the same as absent authData for credential validation during new user creation. Username and password are now required when no valid auth provider data is present.

For more details, see the GitHub Security Advisory GHSA-wjqw-r9x4-j59v and the related pull requests: PR #10219 and PR #10220.

Workarounds

• Implement a Cloud Code beforeSave trigger on the _User class to reject signups where authData is empty and no username/password is provided
• Add server-side validation to check for non-empty authData with valid provider keys before allowing user creation
• Consider implementing rate limiting on user registration endpoints to reduce potential exploitation impact

// Cloud Code workaround - beforeSave trigger for _User class
Parse.Cloud.beforeSave(Parse.User, async (request) => {
  const user = request.object;
  const isNewUser = !user.existed();
  
  if (isNewUser) {
    const authData = user.get('authData');
    const username = user.get('username');
    const password = user.get('password');
    
    // Check if authData is empty or has no valid provider keys
    const hasValidAuthData = authData && 
      Object.keys(authData).length > 0 && 
      Object.values(authData).some(v => v !== null);
    
    // Require username/password if no valid authData
    if (!hasValidAuthData && (!username || !password)) {
      throw new Parse.Error(
        Parse.Error.VALIDATION_ERROR,
        'Username and password required for signup'
      );
    }
  }
});