Parse Server Account Takeover Vulnerability via Authentication Data Injection

A vulnerability in Parse Server allows an unauthenticated attacker to take over user accounts created with authentication providers that do not validate user identifier formats, such as anonymous authentication. This issue affects Parse Server versions 9.0.0 prior to 9.6.0-alpha.12 and 8.6.38 prior to 8.6.38, with both MongoDB and PostgreSQL backends vulnerable. The flaw arises because the server can be tricked into performing a pattern-matching query instead of an exact-match lookup, enabling the attacker to obtain a valid session token for an existing user account.

Impact

Exploitation of this vulnerability allows for unauthorized account takeover, granting the attacker access to the victim's user account.

Remediation

Users can upgrade to Parse Server versions 9.6.0-alpha.12 or 8.6.38 to address this vulnerability.