https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T05:06:40.696775+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-33538 BIT-parse-2026-33538 — Parse Server: Denial of service via unindexed database query for unconfigured auth providers 2026-10-15T05:06:40.699432+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0

 https://cve.radiocsirt.org/vuln/euvd-2026-277258 EUVD-2026-277258 2026-10-15T05:06:40.699488+00:00 EUVD-2026-277258 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33538 fkie_cve-2026-33538 2026-10-15T05:06:40.699505+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0-alpha.52.

 https://cve.radiocsirt.org/vuln/ghsa-g4cf-xj29-wqqr GHSA-g4cf-xj29-wqqr — Parse Server: Denial of Service via unindexed database query for unconfigured auth providers 2026-10-15T05:06:40.699531+00:00

Affected: npm: parse-server

### Impact

An unauthenticated attacker can cause Denial of Service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources.

### Patches

The fix validates that an authentication provider is configured before executing any database query. Requests with unconfigured providers are now rejected immediately without querying the database.

### Workarounds

There is no known workaround other than upgrading.