CVE-2026-30863

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.

• CWE-287
• CWE-863

• https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9vVendor Advisory

Published

Mar 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30858WeKnora is an LLM-powered framework designed for deep docume…7.5
• CVE-2026-30859WeKnora is an LLM-powered framework designed for deep docume…6.5
• CVE-2026-3086GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code…7.8
• CVE-2026-30860WeKnora is an LLM-powered framework designed for deep docume…9.8
• CVE-2026-30861WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-30862Appsmith is a platform to build admin panels, internal tools…9
• CVE-2026-30867CocoaMQTT is a MQTT 5.0 client library for iOS and macOS wri…6.5
• CVE-2026-30868OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-30869SiYuan is a personal knowledge management system. Prior to 3…9.8
• CVE-2026-3087If `shutil.unpack_archive()` is given a ZIP archive with an …7.5
• CVE-2026-30870PowerSync Service is the server-side component of the PowerS…6.5
• CVE-2026-30871OpenWrt Project is a Linux operating system targeting embedd…9.8