The vulnerability in Parse Server’s LDAP authentication adapter allows an attacker to bypass authentication by supplying an empty password. The adapter forwards the client supplied password to the directory without validating that a password has been supplied and treats any non‑error response as an authenticated session. When a zero‑length credential triggers an LDAP simple bind, certain directories—including Active Directory in its default configuration—respond with success, mapping the connection to an anonymous user. The attacker can then obtain a valid session token for the known directory username, effectively taking over the account.

The issue affects parse-community’s Parse Server when the LDAP authentication adapter is enabled. Versions up to and including 8.6.87 and from 9.0.0 up to but not including 9.10.1‑alpha.7 are vulnerable. Deployments that do not enable the LDAP adapter or that use a directory which rejects unauthenticated simple binds, such as a default OpenLDAP configuration, are not exploitable.

The CVSS score is 9.1, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is over the public network to the Parse Server authentication endpoint. An attacker only needs to know the directory username; if the directory accepts unauthenticated simple binds, the attacker can obtain a session token and assume the account’s privileges.