CVE-2026-33409 is an authentication bypass in Parse Server. NVD scores it 9.1 critical. An attacker who knows a user's third party provider ID can log in as that user and get a valid session token. It affects servers with allowExpiredAuthDataToken set to true. Upgrade to 8.6.52 or 9.6.0-alpha.41.
What's affected
Parse Server before 8.6.52 on the 8.x line, and from 9.0.0 before 9.6.0-alpha.41 on the 9.x line. Only deployments that set the server option allowExpiredAuthDataToken to true are exposed. The default is false.
How to check if you're exposed
- List the installed version in your project:
npm ls parse-server
- Search your server configuration, environment and startup code for allowExpiredAuthDataToken. If it is absent or false, the advisory says you are on the safe default.
- Check whether any of your users sign in with a linked third party provider.
What to do now
- Upgrade to 8.6.52, or to 9.6.0-alpha.41 or later on the 9.x line.
- Set allowExpiredAuthDataToken to false, or remove it. The advisory gives this as the workaround and says the option is now deprecated.
- Review login logs for sessions created through linked providers that look unusual.
- Invalidate sessions for accounts you suspect were affected.
Why it matters
The record maps this to CWE-287, improper authentication. When the option was on, the provider could be skipped during login, so the provider ID alone was enough. After the fix, auth providers are always validated on login whatever the setting is.
The GitHub advisory rates it lower than NVD, at 7.0 on CVSS v4, which reflects that the risky option is not the default. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Check whether a flaw like this is reachable in your own code rather than just present in a dependency.
Click through it at your own pace, or open it full screen.
Quick check
I never touched allowExpiredAuthDataToken. Am I exposed?
The advisory says it affects deployments where the option is true, and the default is false. Verify your configuration, then upgrade anyway.
Sources
Last reviewed: 19 October 2026.
