CVE-2026-32248

creationtimestamp| type| source ---|---|--- 2026-03-12 22:17:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgvgiq367b2x 2026-03-13 07:32:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116220700178176253 2026-03-13 08:10:06+00:00| seen|...

CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user...