Is CVE-2026-33042 actively exploited?

No active exploitation of CVE-2026-33042 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33042 be exploited remotely?

Yes. CVE-2026-33042 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33042?

CVE-2026-33042 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33042

MEDIUM

CVE-2026-33042

CWE-287Published: March 18, 2026· Updated: Mar 19, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.8th

Official Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled. The fix in 9.6.0-alpha.29 and 8.6.49 ensures that empty or non-actionable `authData` is treated the same as absent `authData` for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provider data is present. As a workaround, use a Cloud Code `beforeSave` trigger on the `_User` class to reject signups where `authData` is empty and no username/password is provided.

NVD Source

Technical Analysis

CVE-2026-33042 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.