CVE-2026-87806

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.88 Parse Server versions 9.0.0 through 9.10.1-alpha.6

Description An authentication bypass exists in the built-in LDAP authentication adapter. The adapter forwards the client-supplied password to the directory without verifying if a password was provided and treats any non-error response as successful authentication. A zero-length credential converts an LDAP simple bind into an unauthenticated mechanism, which some directories, such as Active Directory in its default configuration, may accept by mapping the connection to anonymous. This allows an unauthenticated attacker with a known directory username to obtain a valid session token and take over the account. This issue only affects deployments with the LDAP authentication adapter enabled and directories that do not refuse unauthenticated simple binds.

Recommendations Update to version 8.6.88. Update to version 9.10.1-alpha.7. Disable the LDAP authentication adapter if it is not required.