Authentication Bypass in Parse Server

Executive Summary

Parse Server versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 have an authentication bypass flaw. Custom AuthAdapter subclasses fail to call their validateSetUp, validateLogin, and validateUpdate methods. Instead, a default implementation accepts any authData, allowing attackers to bypass authentication entirely.

Useful 0 Not Useful 0

Detection Guidance

Check if your Parse Server uses custom AuthAdapter subclasses by inspecting server code for classes extending AuthAdapter. Review logs for unusual authentication attempts or successful logins without valid credentials. Use network monitoring to detect unexpected API calls to /parse/classes/_User or /parse/functions endpoints.

Useful 0 Not Useful 0

Impact Analysis

Attackers can register new accounts, log in as existing users, link identities to accounts, or bypass additional authentication factors. This occurs without valid credentials if your app uses vulnerable custom AuthAdapter subclasses.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unauthorized logins or data access may result in compliance breaches, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Parse Server to patched versions (>= 8.6.102 or >= 9.10.5-alpha.2). If using custom AuthAdapter subclasses, ensure validateSetUp, validateLogin, and validateUpdate methods are properly implemented. Alternatively, switch to plain object adapters or built-in adapters if possible.

Useful 0 Not Useful 0