CVE-2020-26288

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

• CWE-312

• https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92aPatch, Third Party Advisory
• https://github.com/parse-community/parse-server/releases/tag/4.5.0Release Notes, Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3Third Party Advisory
• https://www.npmjs.com/package/parse-serverProduct, Third Party Advisory
• https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92aPatch, Third Party Advisory
• https://github.com/parse-community/parse-server/releases/tag/4.5.0Release Notes, Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3Third Party Advisory
• https://www.npmjs.com/package/parse-serverProduct, Third Party Advisory

Published

Dec 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26282BrowserUp Proxy allows you to manipulate HTTP requests and r…10
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5
• CVE-2020-26285OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26286HedgeDoc is a collaborative platform for writing and sharing…7.5
• CVE-2020-26287HedgeDoc is a collaborative platform for writing and sharing…8.7
• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26290Dex is a federated OpenID Connect provider written in Go. In…9.6
• CVE-2020-26291URI.js is a javascript URL mutation library (npm package uri…6.5
• CVE-2020-26292Creeper is an experimental dynamic, interpreted language. Th…9.8
• CVE-2020-26293HtmlSanitizer is a .NET library for cleaning HTML fragments …6.1