Parse Server は、サインアップ時に空の authData を送信することで認証情報をバイパスされる脆弱性の影響を受けています

The primary impact of CVE-2026-33042 is the ability for an attacker to create authenticated user accounts without providing a username or password. This can lead to unauthorized access to data and resources within the Parse Server application. An attacker could potentially impersonate legitimate users, modify data, or execute malicious code if the application has vulnerabilities that rely on user authentication. The lack of credential enforcement significantly reduces the security posture of the application, allowing for easy account creation and potential compromise. This vulnerability is particularly concerning in environments where user authentication is critical for data protection and access control.

Applications relying on Parse Server for user authentication are at risk, particularly those that have disabled anonymous user signups. Legacy Parse Server deployments running older, unpatched versions are especially vulnerable. Shared hosting environments where Parse Server instances are managed by a third party should also be assessed.

• nodejs / server:

# Check for Parse Server version
ps aux | grep parse-server | grep -oP '(?<=parse-server)[0-9.]+'

• nodejs / server:

# Review Cloud Code 'beforeSave' triggers for user validation logic
# Examine the Parse Server deployment for any custom authentication mechanisms

1. 2026-03-17Disclosure

   disclosure

1. 予約済み2026-03-17
2. 公開日2026-03-17
3. 更新日2026-03-20
4. EPSS 更新日2026-03-26

The recommended mitigation for CVE-2026-33042 is to upgrade Parse Server to version 9.6.0-alpha.29 or later. This version includes a fix that ensures empty or non-actionable authData is treated the same as absent authData for credential validation. As a temporary workaround, implement a Cloud Code beforeSave trigger on the _User class to enforce username and password requirements. This trigger can validate the presence of both fields before allowing user creation. After upgrading, confirm the fix by attempting to create a new user with an empty authData object; the registration should fail.