CVE-2026-87806

Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory.

• CWE-287

• https://github.com/parse-community/parse-server/security/advisories/GHSA-863r-39r9-vfcf
• https://www.vulncheck.com/advisories/parse-server-9.0.0-authentication-bypass-via-ldap-empty-password

Published

Sep 9, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8779A vulnerability was determined in omec-project amf up to 2.1…4.3
• CVE-2026-87794bestzip versions 2.2.6 and 3.0.2 contain an argument injecti…8.4
• CVE-2026-87795zstd-jni versions before 1.5.7-14 fail to validate offset an…8.2
• CVE-2026-8780A vulnerability was identified in omec-project amf up to 2.1…4.3
• CVE-2026-87803An authorization bypass vulnerability exists in the Countly …7.1
• CVE-2026-87804Rejected reason: no security impact
• CVE-2026-87807siyuan versions before v3.8.2 contain an authenticated SQL i…7.5
• CVE-2026-87808SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2…4.9
• CVE-2026-87809Siyuan before v3.8.2 fails to apply publish-access filtering…6.5
• CVE-2026-8781A security flaw has been discovered in omec-project amf up t…4.3
• CVE-2026-87810Siyuan before v3.8.2 contains an information disclosure vuln…5.3
• CVE-2026-87811SiYuan before v3.8.2 inserts persisted notebook template pat…7.3