CVE-2026-30967 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspection endpoint, but does not verify that the token belongs to the user identified by authData.id. An attacker with any valid OAuth2 token from the same provider can authenticate as any other user. This affects any Parse Server deployment that uses the generic OAuth2 authentication adapter (configured with oauth2: true) without setting the useridField option. This vulnerability is fixed in 9.5.2-alpha.9. and 8.6.22.
A vulnerability in the Parse Server OAuth2 authentication adapter can lead to unauthorized account access. This issue is present in Parse Server versions 9.0.0 prior to 9.5.2-alpha.9 and in versions prior to 8.6.22. The vulnerability arises when the adapter is configured with 'oauth2: true' but without the 'useridField' option. In this scenario, the adapter only checks if a token is active through the provider's token introspection endpoint, without verifying that the token belongs to the user identified by 'authData.id'. As a result, an attacker can use any valid OAuth2 token from the same provider to authenticate as another user.
To address this vulnerability, users should update to Parse Server versions 9.5.2-alpha.9 or 8.6.22. Additionally, for deployments using the generic OAuth2 authentication adapter, the 'useridField' option should be set to the appropriate field name for the OAuth2 provider, such as 'sub', to ensure proper token validation against the claimed user ID.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.22 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.9 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-fr88-w35c-r596 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.22 >= 9.0.0, < 9.5.2 9.5.2 alpha1 9.5.2 alpha2 9.5.2 alpha3 9.5.2 alpha4 9.5.2 alpha5 9.5.2 alpha6 9.5.2 alpha7 9.5.2 alpha8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |