Executive brief
Parse Server is a backend framework for building applications with user authentication and data management. The OAuth2 authentication adapter—which allows user sign-in via external OAuth2 providers—shares configuration state across multiple providers using a singleton pattern. During concurrent login attempts from different OAuth2 providers (e.g., Google and GitHub), a token validation intended for one provider may incorrectly use another provider's security policy, potentially accepting a token that should have been rejected. This affects deployments that configure more than one OAuth2 provider.
Technical details
This vulnerability is a concurrent execution race condition (CWE-362) in Parse Server's built-in OAuth2 authentication adapter. The adapter exports a singleton instance that is directly reused across all configured OAuth2 providers instead of creating isolated instances per provider. When multiple OAuth2 authentication requests occur simultaneously for different providers, the shared mutable state can be modified by one request while another request is validating a token, causing token validation to execute against the wrong provider's configuration. An attacker can exploit this by timing concurrent authentication attempts to cause a token rejected by one provider to be accepted because it is validated against a different provider's policy. The vulnerability requires multiple OAuth2 providers to be configured (via the oauth2 flag) and relies on request timing to trigger the race condition. Patches are available: Parse Server 8.6.37 and 9.6.0-alpha.11 fix the issue by creating a new adapter instance for each provider, ensuring configuration isolation.
Affected products
- Parse Community Parse Server All versions prior to 8.6.37; versions >= 9.0.0 prior to 9.6.0-alpha.11
Timeline
- 2026-03-12: disclosed: GHSA-2cjm-2gwv-m892 advisory published
- 2026-03-11: patched: Parse Server 8.6.37 released with fix
- 2026-03-11: patched: Parse Server 9.6.0-alpha.11 released with fix