CVE-2026-34373 identifies a critical vulnerability in Parse Server (versions prior to 8.6.66 and 9.7.0-alpha.10) where the GraphQL API endpoint bypasses configured cross-origin resource sharing (CORS) restrictions. This allows unauthenticated attackers to make unrestricted cross-origin requests, resulting in a high CVSS score of 8.8 due to potential impacts on confidentiality, integrity, and availability. Although no public exploit code exists and it is not in the CISA KEV catalog, the vulnerability is on an "Active" hot list and has received some community attention, suggesting a potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.5.0, < 8.6.66CPE matchmatch criteria | cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* | ||
>= 9.0.0, < 9.7.0CPE matchmatch criteria | cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* | ||
9.7.0CPE matchmatch criteria | cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha1:*:*:*:node.js:*:* | ||
9.7.0CPE matchmatch criteria | cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha2:*:*:*:node.js:*:* | ||
9.7.0CPE matchmatch criteria | cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha3:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.