CVE-2026-30967

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspection endpoint, but does not verify that the token belongs to the user identified by authData.id. An attacker with any valid OAuth2 token from the same provider can authenticate as any other user. This affects any Parse Server deployment that uses the generic OAuth2 authentication adapter (configured with oauth2: true) without setting the useridField option. This vulnerability is fixed in 9.5.2-alpha.9. and 8.6.22.

• CWE-287

• https://github.com/parse-community/parse-server/releases/tag/8.6.22Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.9Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-fr88-w35c-r596Patch, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30961Gokapi is a self-hosted file sharing server with automatic e…4.3
• CVE-2026-30962Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-30963Capsule is a multi-tenancy and policy-based framework for Ku…2.7
• CVE-2026-30964web-auth/webauthn-lib is an open source set of PHP libraries…5.4
• CVE-2026-30965Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-30966Parse Server is an open source backend that can be deployed …10
• CVE-2026-30968Coral Server is open collaboration infrastructure that enabl…9.8
• CVE-2026-30969Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30970Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30972Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30973Appium is an automation framework that provides WebDriver-ba…6.5
• CVE-2026-30974Copyparty is a portable file server. Prior to v1.20.11., the…5.4