Executive brief
Parse Server is a backend-as-a-service platform that manages user authentication and data storage. When configured to use OAuth2 authentication with app ID validation, a bug causes the wrong token to be sent to the introspection endpoint, which can either block all legitimate logins or allow unauthorized access depending on the endpoint's implementation. Organizations using OAuth2 with app ID constraints are at risk of either denial of service or authentication bypass.
Technical details
This vulnerability is a logic error in the OAuth2 authentication adapter's app ID validation method. When appidField and appIds are configured, the adapter sends a malformed value to the token introspection endpoint instead of the user's actual access token, due to incorrect parameter alignment. The vulnerability requires OAuth2 authentication to be enabled with specific configuration (appidField and appIds must be set). An attacker can exploit this by sending OAuth2 authentication requests; depending on the introspection endpoint's error handling, this could either cause all authentication attempts to fail (denial of service) or, if the endpoint returns valid-like responses to malformed requests, allow authentication from disallowed app contexts (authentication bypass). Patches are available in Parse Server 8.6.39 and 9.6.0-alpha.13.
Affected products
- Parse Community Parse Server 8.0.2 to 8.6.38, 9.0.0 to 9.6.0-alpha.12
Timeline
- 2026-03-12: disclosed: Security advisory published
- 2026-03-13: patched: Parse Server 8.6.39 and 9.6.0-alpha.13 released