CVE-2026-87806
Parse Server versions up to 8.6.87 and from 9.0.0 to 9.10.1‑alpha.6 contain an authentication bypass in the LDAP adapter. The bug lets an attacker supply an empty password, causing the server to treat the directory’s anonymous bind as a successful login and issue a valid session token. Upgrading to the fixed releases removes the flaw.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Parse Server installations using the LDAP authentication adapter on versions 8.6.87 or earlier, or 9.0.0 through 9.10.1‑alpha.6. Users who rely on LDAP for user authentication are at risk.
Real-world impact
An unauthenticated attacker who knows a directory username can obtain a valid session token for that account, effectively taking over the account without needing a password.
Why this severity
The CVSS score of 9.1 reflects a critical authentication bypass that requires no user interaction, no privileges, and grants full control over the affected account. The flaw provides high confidentiality and integrity impact, and the attacker can act as any user in the directory.
What to do about it
- 01Upgrade Parse Server to version 8.6.88 or later, or to 9.10.1‑alpha.7 or later, which enforce a non‑empty password before contacting the LDAP directory.
- 02Restart the Parse Server service to apply the new version.
- ›If an upgrade is not immediately possible, disable the LDAP authentication adapter in Parse Server’s configuration.
- ›Alternatively, configure the LDAP directory to reject unauthenticated simple bind requests (e.g., use a stock OpenLDAP configuration).
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.