CVE-2026-87806

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

CVE-2026-87806

Parse Server versions = 9.0.0

CVE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

PT-2026-88944

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.88 Parse Server versions 9.0.0 through 9.10.1-alpha.6 Description An authentication bypass exists in the built-in LDAP authentication adapter. The adapter forwards the client-supplied password to the director...