CVE-2026-32594: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32594 is a missing authentication vulnerability in Parse Server's GraphQL WebSocket subscription endpoint that allows unauthenticated attackers to bypass security middleware. The flaw affects all Parse Server deployments using the GraphQL API: versions prior to 8.6.40 and versions 9.0.0 through prior to 9.6.0 (including alpha releases up to 9.6.0-alpha.13) for Node.js. It was disclosed on March 13, 2026, via a GitHub Security Advisory (GHSA-p2x3-8689-cwpg). The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). The GraphQL WebSocket endpoint for subscriptions (/subscriptions by default), implemented via the subscriptions-transport-ws library and the createSubscriptions method in ParseGraphQLServer.js, was set up independently of the Express middleware chain. As a result, it did not enforce authentication (application/API key validation), introspection access controls, or query complexity limits that protect the standard HTTP GraphQL endpoint. An attacker can establish a raw WebSocket connection to the /subscriptions path and send arbitrary GraphQL operations — including introspection queries — without supplying any credentials. The fix removed the entire unfinished WebSocket subscription feature, including the createSubscriptions method and the subscriptions-transport-ws dependency, since GraphQL subscriptions were never functional in Parse Server (the schema defined no subscription types) (GitHub Advisory, PR #10190).

Successful exploitation allows an unauthenticated attacker to execute GraphQL operations without valid application or API credentials, access the full GraphQL schema via introspection even when public introspection is disabled, and submit arbitrarily complex queries that bypass configured complexity limits. This can result in unauthorized data access (confidentiality impact), minor unauthorized data modifications (integrity impact), and potential denial of service through resource exhaustion from unbounded query complexity (availability impact). The scope is limited to the vulnerable Parse Server instance itself, with no direct lateral movement to subsequent systems (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to the WebSocket endpoint, making it trivially exploitable if exposed. The EPSS score is approximately 0.075% (0.000750), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The reporter is credited as fancymalware (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Parse Server instances with the GraphQL API enabled using tools like Shodan or Censys, looking for services exposing the /graphql and /subscriptions paths.
2. Confirm vulnerability: Attempt an HTTP OPTIONS or GET request to /subscriptions to confirm the endpoint exists, or check the server version against the affected range (< 8.6.40 or 9.0.0–9.5.x).
3. Establish WebSocket connection: Using a WebSocket client (e.g., wscat, a browser DevTools console, or a custom script), initiate a WebSocket upgrade request to ws://<target>/subscriptions without providing any X-Parse-Application-Id or API key headers.
4. Execute unauthenticated GraphQL operations: Once connected, send GraphQL operation messages over the WebSocket. For example, send an introspection query payload: {"type":"start","id":"1","payload":{"query":"{ __schema { types { name } } }"}} to enumerate the full schema even if introspection is disabled on the HTTP endpoint.
5. Send complex queries: Submit arbitrarily deeply nested or high-field-count queries that would normally be rejected by complexity limits on the HTTP endpoint, potentially exhausting server resources.
6. Data access: Use schema knowledge to craft targeted data queries against Parse Server classes, retrieving application data without authentication (GitHub Advisory, PR #10189).

• Network: Unexpected WebSocket upgrade requests (HTTP 101 Switching Protocols) to the /subscriptions path from external or untrusted IP addresses; WebSocket connections to ws://<server>/subscriptions without accompanying X-Parse-Application-Id headers.
• Logs: HTTP access log entries showing GET /subscriptions with Upgrade: websocket headers from unauthenticated clients; absence of X-Parse-Application-Id or X-Parse-REST-API-Key in WebSocket upgrade requests that succeed.
• Application Behavior: Unusual server resource consumption (CPU/memory spikes) consistent with unbounded GraphQL query complexity; GraphQL introspection responses returned to clients that did not authenticate via the HTTP endpoint.

Upgrade Parse Server to version 8.6.40 (LTS branch, PR #10190) or 9.6.0 / 9.6.0-alpha.14 (v9 branch, PR #10189) to fully remediate the vulnerability by removing the vulnerable WebSocket subscription feature. If immediate patching is not possible, block WebSocket upgrade requests to the GraphQL subscriptions path (default: /subscriptions) at the network level using a reverse proxy or load balancer rule — for example, configuring nginx or AWS ALB to reject Upgrade: websocket requests to that path. Restricting network access to the Parse Server GraphQL endpoint to trusted sources only provides additional defense in depth (GitHub Advisory, PR #10190, PR #10189).