CVE-2026-31828

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP Distinguished Names (DN) and group search filters without escaping special characters. This allows an attacker with valid LDAP credentials to manipulate the bind DN structure and to bypass group membership checks. This enables privilege escalation from any authenticated LDAP user to a member of any restricted group. The vulnerability affects Parse Server deployments that use the LDAP authentication adapter with group-based access control. This vulnerability is fixed in 9.5.2-alpha.13 and 8.6.26.

• CWE-90

• https://github.com/parse-community/parse-server/releases/tag/8.6.26Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.13Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47cPatch, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31822Sylius is an Open Source eCommerce Framework on Symfony. A c…6.1
• CVE-2026-31823Sylius is an Open Source eCommerce Framework on Symfony. An …4.8
• CVE-2026-31824Sylius is an Open Source eCommerce Framework on Symfony. A T…5.9
• CVE-2026-31825Sylius is an Open Source eCommerce Framework on Symfony. Syl…5.3
• CVE-2026-31826pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-31827Alienbin is an anonymous code and text sharing web service. …7.1
• CVE-2026-31829Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-3183Zohocorp ManageEngine ADSelfService Plus versions before 652…7.1
• CVE-2026-31830sigstore-ruby is a pure Ruby implementation of the sigstore …7.5
• CVE-2026-31831Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2026-31832Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and …5.4
• CVE-2026-31833Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and …6.7