{"id":"CVE-2026-33538","aliases":["BIT-parse-2026-33538","GHSA-g4cf-xj29-wqqr"],"url":"https://o3.security/vulnerability/CVE-2026-33538","summary":"Parse Server: Denial of service via unindexed database query for unconfigured auth providers","details":"### Impact\n\nAn unauthenticated attacker can cause Denial of Service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources.\n\n### Patches\n\nThe fix validates that an authentication provider is configured before executing any database query. Requests with unconfigured providers are now rejected immediately without querying the database.\n\n### Workarounds\n\nThere is no known workaround other than upgrading.","published":"2026-03-24T18:24:51.595Z","modified":"2026-08-12T03:51:38.644953319Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"parse-server","fixedVersion":"9.6.0-alpha.52"},{"ecosystem":"npm","name":"parse-server","fixedVersion":"8.6.58"}],"fix":{"url":"https://github.com/parse-community/parse-server/commit/40eb442e02672986730007d0a1edb22c1c4bd357","label":"parse-community/parse-server@40eb442"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33538.json"},{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33538"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/40eb442e02672986730007d0a1edb22c1c4bd357"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/fbac847499e57f243315c5fc7135be1d58bb8e54"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/10270"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/10271"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.644953319Z"}}