CVE-2025-30168 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2.
A vulnerability in Parse Server's third-party authentication handling allows authentication credentials from certain providers to be used across multiple Parse Server applications. This issue affects Parse Server versions prior to 7.5.2 and 8.0.0 through 8.0.2. The vulnerability arises when a user signs up with the same authentication provider in two unrelated Parse Server apps. In such cases, credentials from one app can be used to authenticate the user in the other app. This issue specifically impacts Parse Server applications that utilize an affected third-party authentication provider for user authentication, as configured in the Parse Server options.
Upgrade Parse Server to version 7.5.2 or 8.0.2, and ensure that the client application is updated to send a secure payload instead of the previous insecure one. For a gradual rollout of the client app update, the affected Parse Server authentication adapters can be configured to accept both insecure and secure payloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 21, 2025CISA-ADP
Assessed Mar 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication | [email protected] | Technical DescriptionVendor |
| https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e | [email protected] | Source CodeVendor |
| https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f | [email protected] | Source CodeVendor |
| https://github.com/parse-community/parse-server/pull/9667 | [email protected] | Issue TrackingVendor |
| https://github.com/parse-community/parse-server/pull/9668 | [email protected] | Issue TrackingVendor |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Parse Server | < 7.5.2 (semver) >= 8.0.0, < 8.0.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2025 | New CVE Received | [email protected] |