Executive brief
Parse Server is a backend framework that provides user authentication and data management. The OAuth2 authentication adapter in Parse Server fails to properly validate that an OAuth2 token belongs to the user claiming that identity, allowing an attacker with any valid token from the same provider to impersonate any other user and take over their account.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the OAuth2 authentication adapter. When configured without the useridField option, the adapter only validates that an OAuth2 token is active via the provider's token introspection endpoint, but fails to verify that the token belongs to the user identified by authData.id. An attacker with any valid OAuth2 token from the same provider can call the authentication endpoint with another user's authData.id and gain access to that user's account. The attack requires network access and a valid OAuth2 token from the provider, but no special privileges or user interaction. Patches are available in Parse Server 8.6.22 and 9.5.2-alpha.9, which default useridField to 'sub' per RFC 7662.
Affected products
- Parse Community Parse Server 0 through 8.6.21; 9.0.0-alpha.1 through 9.5.2-alpha.8
Timeline
- 2026-03-10: disclosed: Published to NVD
- 2026-03-10: patched: Patches released: Parse Server 8.6.22 and 9.5.2-alpha.9