Parse Server CVE-2026-101042

Exploitation requires the Parse Server deployment to have configured at least one of the affected code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, or Weibo); installs without these adapters are not affected. The attacker must already hold a valid low-privileged authenticated account (PR:L) to reach the login endpoint and submit username/password together with forged provider authData. The account pre-hijack variant additionally depends on victim interaction - a targeted victim who has not yet linked the provider must later perform a legitimate provider sign-in (UI:P) for the hijack to resolve to the attacker. These factors (non-default adapter configuration plus required authentication) meaningfully limit the exploitable population.

This is a genuine but conditional authentication/authorization flaw (CWE-287) rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P) shows a network-reachable but authenticated attack that requires an existing low-privileged account (PR:L) and a specific attack requirement (AT:P) - namely a deployment that has configured one of the affected code-based auth adapters. No EPSS score, no CISA KEV listing, and no public POC are provided, so the exploitation status is: no public exploit identified at time of analysis. The 7.4 score is driven by high confidentiality and integrity impact (VC:H/VI:H) because a spoofed/pre-hijacked provider identity can subvert any application logic that trusts the linked provider ID. The AT:P condition is the key risk limiter: only deployments using GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, or Weibo code-based adapters are affected - default Parse Server installs without these adapters are not exploitable. Signals are internally consistent (authenticated, network, config-dependent); nothing in the description contradicts the vector. Net: a real priority for the subset of Parse Server deployments using these adapters, low urgency elsewhere.

A low-privileged attacker who can register/log in to a Parse Server app configured with a code-based auth adapter (e.g., LinkedIn or Microsoft) sends a login request combining their own username/password with crafted authData for the provider; because the server never contacts the provider on that endpoint, an arbitrary unverified provider identity is attached to the attacker's account. Alternatively, the attacker pre-claims the provider ID of a victim who has not yet linked that provider, so the victim's later legitimate provider sign-in resolves into the attacker's account. No public exploit code is identified at time of analysis.