Executive Summary

This vulnerability affects Parse Server versions prior to 8.6.58 and 9.6.0-alpha.52. An unauthenticated attacker can send authentication requests using arbitrary provider names that are not configured on the server.

For each such unconfigured provider name, the server executes a database query without an index, causing a full collection scan on the user database.

Because these requests can be sent in parallel, the attacker can saturate database resources, leading to a denial of service condition.

This issue has been fixed in Parse Server versions 8.6.58 and 9.6.0-alpha.52.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited to cause a denial of service (DoS) on the Parse Server backend.

By sending multiple authentication requests with arbitrary, unconfigured provider names, an attacker can overload the database with expensive queries.

This can saturate database resources, potentially making the backend unavailable to legitimate users and disrupting service.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Parse Server to version 8.6.58 or later, or to version 9.6.0-alpha.52 or later. These versions contain patches that prevent unauthenticated attackers from causing denial of service by sending authentication requests with arbitrary, unconfigured provider names.

Useful 0 Not Useful 0