Executive brief
Parse Server, a popular backend-as-a-service platform, has a vulnerability in its OAuth and third-party authentication handling that allows authentication credentials from one Parse Server application to be reused to authenticate users in completely different Parse Server applications. An attacker who gains access to a user's authentication credentials in one app could potentially use those same credentials to gain unauthorized access to the same user's account in an unrelated app, compromising data privacy and user account security.
Technical details
The vulnerability is an improper authentication handling flaw (CWE-287) in Parse Server's third-party OAuth authentication adapters. When users authenticate via OAuth providers, the credentials are stored without proper application-level isolation, allowing them to be reused across multiple Parse Server instances. The vulnerability requires user interaction (to initiate authentication) and a network connection, but does not require elevated privileges. An attacker can exploit this by obtaining authentication credentials from one Parse Server app and using them to authenticate in another unrelated app using the same OAuth provider. Patches are available in Parse Server 7.5.2 and 8.0.2; however, both the server and client applications must be updated, and an optional enableInsecureAuth option is provided for gradual migration.
Affected products
- Parse Community Parse Server before 7.5.2 and 8.0.0 before 8.0.2
Timeline
- 2025-03-21: disclosed: Vulnerability published in GHSA-837q-jhwx-cmpv
- 2025-03-21: patched: Parse Server 7.5.2 and 8.0.2 contain fixes