CVE-2026-33409

Estado: AnalizadaAlta (7)—

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0-alpha.41.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.56%
Percentil entre todas las CVEs puntuadas: 44
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution75 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access95 %
Impacto secundarioT1556 Modify Authentication Processdefense impairment · persistence · credential access70 %

Requiere interacción del usuario (UI:A) y acceso a red con privilegios altos (PR:H). El atacante bypasa autenticación usando provider ID conocido para obtener sesión válida. Parse Server config vulnerable por allowExpiredAuthDataToken=true.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account Management Privileged Account Management Password Policies Multi-factor Authentication Application Developer Guidance Active Directory Configuration

Tecnologías afectadas (1)

Parseplatform — Parse-server

CWE

CWE-287

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-33409",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33409",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-25T13:39:16.578117Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.6.52"
            },
            {
              "status": "affected",
              "version": ">= 9.0.0, < 9.6.0-alpha.41"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-24T19:16:53.287",
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/commit/98f4ba5bcf2c199bfe6225f672e8edcd08ba732d",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10246",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10247",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0-alpha.41."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.52 y 9.6.0-alpha.41, una vulnerabilidad de omisión de autenticación permite a un atacante iniciar sesión como cualquier usuario que haya vinculado un proveedor de autenticación de terceros, sin conocer las credenciales del usuario. El atacante solo necesita conocer el ID de proveedor del usuario para obtener acceso completo a su cuenta, incluyendo un token de sesión válido. Esto afecta a las implementaciones de Parse Server donde la opción del servidor allowExpiredAuthDataToken está configurada como true. El valor predeterminado es false. Este problema ha sido parcheado en las versiones 8.6.52 y 9.6.0-alpha.41."
    }
  ],
  "lastModified": "2026-06-17T10:37:26.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3707A6E9-1326-45A4-B189-091E03E4E604",
              "versionEndExcluding": "8.6.52"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A",
              "versionEndExcluding": "9.6.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B84C28F8-AADE-41BB-A0EF-B701AB57DC3A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7567BB81-7837-4265-B792-6A9B73CECF93"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0035C6F1-21B9-42D1-BE29-690905F3558C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "623FB30A-0693-4449-80FA-16D36B1BE66C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B420167-CD3E-45A7-AD9A-0F83AEC634BA"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "030A8626-DBBD-4BF2-B362-79B44FB1204D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D38CFCC3-2AA9-4C8E-9064-FE97E6E8C45C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65BB78F2-3A1A-4CD1-B8A8-4AB043B5CA50"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC98AF7-8620-4A25-9BE5-623672599677"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23E28E0F-9379-4628-B9DC-8C94A45902CF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6631BE51-74FB-40C0-9E91-0EDF2DCADD7A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B0E4254-14A3-4EB6-9E98-CF45EB08B17F"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF63FDE-75F5-44B6-A958-CF653D84D3B4"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "252B812D-A162-41C1-91CD-08D0CBAC5C46"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "421691EA-F55A-4738-8ABD-74B53B6DF155"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E7FAB59-142E-4191-9A6F-0744D810CD81"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B010F310-05A1-48AE-B002-8F4C7FA62EB3"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D3B2C32-16D8-415B-A49F-060ECE8F0F33"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43BE83C2-C756-4A5A-A340-B7D1FB52078D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF340605-8CC8-4543-9F5D-E8602D258CED"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702EBB22-3E9F-4CBE-B855-2E3642C530B1"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C17AD66-684F-4662-AF16-838FF05F47D5"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13C25963-CAE7-49AA-A941-254DCE289E35"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6BF0C2F-DD2B-4864-961F-CA808EF22633"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FBB21E9-CB73-4CB1-841A-D1C08167DB51"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD55F0B-D854-43D4-A0F5-F83386DB24C9"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1097E8DF-3D0E-47C6-882D-E37B22119538"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C60F121-1C0B-4EB5-87EF-F1BED070C13B"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04D8514D-CC66-4E6B-90C8-6108F0DAA661"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB65A73-7BB7-42E4-97A3-4D6305172E05"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A052DFCA-EDCC-43D7-82C7-E5311F6F7687"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "192A78FB-E141-4F14-8C4A-20A4118B01C9"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12B11714-B961-4330-B241-FC5AF94FDBE8"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37A7C42B-4986-4BB6-BB27-0324A9AA1CFF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C793834B-64B4-4DE9-BD7D-79B52C30C34E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AD455C8-88BE-4A0A-B33D-3A7811FFB753"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26C475A2-997C-4C3A-8CB6-04AB3534BBC3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}