Parse Server has an auth provider validation bypass on login via partial authData

緊急 9.1CVE-2026-33409 · BIT-parse-2026-33409 · GHSA-pfj7-wv7c-22pr · 24/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-33409 は parse-server (parseplatform), parse-server に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.47%（全脆弱性の 40.9% より高い）。
対処：9.6.0, 8.6.52, 9.6.0-alpha.41 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server parseplatform	`= 9.6.0≥ 9.0.0, < 9.6.0< 8.6.52`	`9.6.08.6.52`
parse-server npm	`≥ 9.0.0, < 9.6.0-alpha.41< 8.6.52`	`9.6.0-alpha.418.6.52`

概要

Impact

An authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token.

This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false.

Patches

Auth providers are now always validated on login, regardless of the allowExpiredAuthDataToken setting. The option allowExpiredAuthDataToken has been deprecated and will be removed in a future major version.

Workarounds

Set allowExpiredAuthDataToken to false (the default) or remove the option from the server configuration.

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0-alpha.41.