Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M
CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Critical 9.3
In plain English
A critical-severity improper authentication in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | parse-server | 9.5.0-alpha.11 | GHSA-x6fw-778m-wr9v |
| npm | parse-server | 8.6.10 | GHSA-x6fw-778m-wr9v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | < 8.6.10< 9.5.0-alpha.11 |
Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N