Parse Server is an open source backend that can run on any Node.js environment. Before version 8.6.58 and 9.6.0‑alpha.52, an attacker who does not need any authentication can trigger a denial of service by requesting authentication with provider names that the instance has not configured. Each such request forces the server to perform a database query on the whole user collection, where the column for provider names is not indexed. The full collection scan consumes database resources and can be parallelised, leading to a slowdown or crash of the web service.

Affected systems include parse-community’s Parse Server for Node.js. Versions older than 8.6.58 and 9.6.0‑alpha.52 are vulnerable. The problem exists in the authentication module of Parse Server and is triggered by arbitrary provider strings supplied in the authentication request.

The vulnerability carries a CVSS score of 8.7 and an EPSS score below 1 %, indicating a high severity but low current exploit probability. It has not been reported in CISA’s KEV catalog. The attack vector is a remote unauthenticated HTTP request to the login endpoint, and the attacker can send many such requests in parallel. Updating to the patched versions eliminates the insecure logic and removes the unindexed database query, thereby preventing the denial of service.