CVE-2026-87806

Parse Server versions through 8.6.87 and the 9.x line before 9.10.1-alpha.7 contain an authentication bypass (CWE-287) in the built-in LDAP authentication adapter: it forwards the client-supplied password to the directory without verifying that one was provided and treats any non-error directory response as proof of authentication. An attacker who submits a zero-length credential turns the LDAP simple bind into the unauthenticated bind mechanism of RFC 4513 section 5.1.2, which directories such as Active Directory in its default configuration answer with success while mapping the connection to anonymous. Knowing only a directory username, an unauthenticated remote attacker can therefore obtain a valid session token for that account, achieving full account takeover with no privileges or user interaction (CVSS 4.0: 9.1, critical). Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple binds, such as a stock OpenLDAP configuration, are not exploitable. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; fixed releases 8.6.88 and 9.10.1-alpha.7 require the password to be a non-empty string and reject the request before contacting the directory.

What to do: Upgrade to Parse Server 8.6.88 (8.x line) or 9.10.1-alpha.7 or later (9.x line), which require a non-empty password before attempting the LDAP bind. If patching is not immediately possible, disable the LDAP authentication adapter or configure the directory to reject unauthenticated simple binds. Check your Parse Server configuration for an enabled 'ldap' auth provider to determine whether your deployment is in scope.