CVE-2026-87806: Parse Server LDAP Auth Bypass Vulnerability

CVE-2026-87806 Overview

CVE-2026-87806 is an authentication bypass vulnerability in the Parse Server built-in Lightweight Directory Access Protocol (LDAP) authentication adapter. The adapter forwards a client-supplied password to the directory without verifying that a password was actually supplied. It then treats any non-error response as proof of authentication. A zero-length credential converts an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2. Directories such as Active Directory answer this bind with success while mapping the connection to anonymous. An unauthenticated attacker who knows a valid directory username can obtain a session token for that account [CWE-287].

Critical Impact
Remote, unauthenticated attackers can take over any account whose username they know when Parse Server is configured with the LDAP adapter against a permissive directory such as default Active Directory.

Affected Products

Parse Server versions <= 8.6.87
Parse Server versions >= 9.0.0 and < 9.10.1-alpha.7
Only deployments that enable the built-in LDAP authentication adapter are affected

Discovery Timeline

2026-09-09 - CVE-2026-87806 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87806

Vulnerability Analysis

Parse Server ships an LDAP authentication adapter that authenticates users by performing an LDAP simple bind against a configured directory. The adapter passes the password value supplied by the client directly to the LDAP client library. It does not check whether the value is a non-empty string. When the directory returns any non-error response, the adapter treats the bind as successful and issues a Parse session token for the requested username.

An LDAP simple bind with a distinguished name and an empty password is defined by RFC 4513 as the unauthenticated authentication mechanism. Many directory implementations, including Active Directory in its default configuration, respond to such a bind with success while silently mapping the connection to anonymous. The adapter cannot distinguish this response from a genuine credential validation. The fix in Parse Server 8.6.88 and 9.10.1-alpha.7 requires the password to be a non-empty string and rejects the request before contacting the directory.

Root Cause

The root cause is missing input validation on the password parameter combined with reliance on the directory's bind response as the sole authentication signal. The adapter conflates a protocol-level success response with credential verification.

Attack Vector

An unauthenticated attacker sends an authentication request to a Parse Server endpoint that invokes the LDAP adapter. The attacker supplies a valid directory username and an empty password. The adapter forwards the empty credential to the directory, receives an anonymous-bind success, and returns a valid Parse session token bound to the targeted user. Deployments whose directory refuses unauthenticated simple bind, such as a stock OpenLDAP configuration, are not exploitable.

No verified proof-of-concept code has been released. Refer to the Parse Server GitHub Security Advisory and the VulnCheck Advisory on LDAP Bypass for technical details.

Detection Methods for CVE-2026-87806

Indicators of Compromise

Parse Server authentication requests containing an empty or missing password field routed to the LDAP adapter.
Directory server logs showing successful simple binds with a populated bindDN but zero-length password, immediately followed by anonymous operations.
Issuance of Parse session tokens for accounts that did not perform an interactive login on the client side.

Detection Strategies

Inspect Parse Server request logs for authentication payloads where the LDAP adapter is invoked with a null, empty, or whitespace-only password.
Correlate Parse session token issuance events with corresponding LDAP bind events on the directory to identify unauthenticated binds resulting in session grants.
Alert on any Active Directory event ID 4624 with logon type 3 that resolves to an anonymous logon following a Parse Server bind attempt.

Monitoring Recommendations

Enable verbose logging on the Parse Server authentication pipeline and forward events to a central analytics platform for longitudinal review.
Configure directory servers to log unauthenticated bind attempts and generate alerts on any success response for such binds.
Track anomalous session token issuance patterns, particularly bursts of tokens for distinct users originating from a single client IP.

How to Mitigate CVE-2026-87806

Immediate Actions Required

Upgrade Parse Server to 8.6.88 or 9.10.1-alpha.7 or later, which reject empty passwords before contacting the directory.
If upgrading is not immediately possible, disable the built-in LDAP authentication adapter until the patch is applied.
Rotate credentials and invalidate active Parse session tokens for any account that may have been targeted while the vulnerable adapter was exposed.

Patch Information

The issue is fixed in Parse Server 8.6.88 and 9.10.1-alpha.7. The patched adapter validates that the password is a non-empty string and returns an authentication failure before initiating the LDAP bind. See the Parse Server GitHub Security Advisory for release details.

Workarounds

Reconfigure the backing directory to reject unauthenticated simple binds. On Active Directory, set the LDAPServerIntegrity policy and disable anonymous binds through domain controller policy.
Front the Parse Server LDAP endpoint with a reverse proxy or middleware that rejects requests with empty password fields.
Restrict network reachability of the Parse Server authentication endpoint to trusted client networks until the patch is deployed.

bash

# Configuration example: upgrade Parse Server to a fixed release
npm install parse-server@8.6.88
# or, for the 9.x line
npm install parse-server@9.10.1-alpha.7