Denial of Service Vulnerability in Parse Server by Parse Community

CVE-2026-33538

What is CVE-2026-33538?

Parse Server, a widely-used open-source backend framework, has a vulnerability that allows unauthenticated attackers to create denial of service conditions. When an attacker sends authentication requests containing arbitrary provider names that are not configured, the server conducts a database query for each provider. This results in full collection scans on the user database, as there is no index for these unconfigured providers, severely taxing database resources and potentially leading to resource saturation. This vulnerability impacts versions prior to 8.6.58 and 9.6.0-alpha.52. The issue has been resolved in the latest releases.

References