Parse Server allows bypass of the username/password requirement during user sign‑up when an empty authData object is submitted. This flaw is a classic insecure authentication weakness (CWE‑287) and permits attackers to create authenticated sessions without providing credentials. The resulting unauthorized accounts grant access to any application functionality that believes the account is legitimate, potentially compromising confidentiality and integrity of data associated with that session.

Affected products are parse-community Parse Server prior to 9.6.0‑alpha.29 and 8.6.49. Any deployment of those versions running on Node.js is vulnerable, including all builds listed in the CPE set, up to alpha.28.

The CVSS score is 6.9, indicating moderate severity, and the EPSS is below 1%, suggesting low current exploitation probability. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a crafted request to the signup API; no authentication or privileged access is needed. The likely attack vector is a client‑direct request to the user sign‑up endpoint with an empty authData payload.