Executive brief
Parse Server is a backend-as-a-service framework that manages user authentication and data storage for mobile and web applications. A vulnerability in the Google authentication adapter allows an attacker to forge authentication tokens by claiming an "alg: none" algorithm, enabling account takeover of any user with a linked Google account without knowing their password. All Parse Server deployments with Google authentication enabled are affected.
Technical details
The vulnerability is a JWT algorithm confusion attack (CWE-327, CWE-345) in Parse Server's Google authentication adapter. The root cause is that the adapter trusts the `alg` parameter from the JWT header instead of enforcing the expected RS256 algorithm, allowing an attacker to craft a token with `alg: "none"` that bypasses signature verification. The attack requires only network access—no authentication or user interaction is needed. An attacker can forge a valid-looking Google ID token and use it to log in as any user linked to a Google account. The fix hardcodes RS256 as the required algorithm and replaces the custom key fetcher with jwks-rsa, which rejects unknown key IDs. Patches are available in Parse Server 8.6.3 and 9.3.1-alpha.4.
Affected products
- Parse Community Parse Server All versions before 8.6.3 and versions 9.0.0 before 9.3.1-alpha.4
Timeline
- 2026-02-25: disclosed
- 2026-02-23: patched: Fix commits prepared
- 2026-02-25: advisory: GitHub Security Advisory GHSA-4q3h-vp4r-prv2 published
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
- https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7
- https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/8.6.3
- https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4