CVE-2025-30168

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2.

• CWE-287

• https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
• https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
• https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
• https://github.com/parse-community/parse-server/pull/9667
• https://github.com/parse-community/parse-server/pull/9668
• https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30162Cilium is a networking, observability, and security solution…4.3
• CVE-2025-30163Cilium is a networking, observability, and security solution…4.7
• CVE-2025-30164Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-30165vLLM is an inference and serving engine for large language m…8
• CVE-2025-30166Pimcore's Admin Classic Bundle provides a Backend UI for Pim…4.8
• CVE-2025-30167Jupyter Core is a package for the core common functionality …7.3
• CVE-2025-30169File upload and execute vulnerabilities in ASPECT allow PHP …6.7
• CVE-2025-3017A vulnerability, which was classified as critical, has been …5.3
• CVE-2025-30170Exposure of file path, file size or file existence vulnerabi…5.9
• CVE-2025-30171System File Deletion vulnerabilities in ASPECT provide attac…9
• CVE-2025-30172Remote Code Execution vulnerabilities are present in ASPECT …8.9
• CVE-2025-30173File upload vulnerabilities are present in ASPECT if session…6.7