CVE-2026-33409 Auth Provider Validation Bypass via Partial AuthData

CVE-2026-33409 is a critical-severity vulnerability. AttackerView checks Parse Server sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-33409?

Detects Parse Server instances where allowExpiredAuthDataToken is enabled and auth provider validation is skipped on login when authData matches stored data. An attacker who obtains stored authData can impersonate any user with linked OAuth accounts, gaining a valid session token without the provider re-validating credentials. Affects versions before 8.6.52 and 9.0.0 through 9.6.0-alpha.40.