7.5

CVE-2026-33538

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0-alpha.52.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.58
Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.6.0
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha1 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha10 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha11 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha12 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha13 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha14 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha15 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha16 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha17 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha18 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha19 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha2 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha20 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha21 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha22 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha23 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha24 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha25 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha26 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha27 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha28 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha29 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha3 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha30 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha31 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha32 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha33 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha34 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha35 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha36 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha37 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha38 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha39 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha4 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha40 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha41 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha42 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha43 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha44 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha45 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha46 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha47 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha48 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha49 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha5 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha50 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha51 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha6 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha7 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha8 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha9 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.322
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr
Vendor Advisory
https://github.com/parse-community/parse-server/pull/10270
Issue Tracking
https://github.com/parse-community/parse-server/pull/10271
Issue Tracking
https://github.com/parse-community/parse-server/commit/40eb442e02672986730007d0a1edb22c1c4bd357
Patch
https://github.com/parse-community/parse-server/commit/fbac847499e57f243315c5fc7135be1d58bb8e54
Patch