What is the CVSS score of CVE-2026-27804?

CVE-2026-27804 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-27804?

This critical vulnerability allows attackers to impersonate any user with Google authentication without credentials, potentially compromising user accounts and sensitive data across all Parse Server…. A patch is available.

How to fix or mitigate CVE-2026-27804?

Within 24 hours: Identify all Parse Server instances with Google authentication enabled and assess exposure. Within 7 days: Apply vendor patches (versions 8.6.3 or 9.1.1-alpha.4 or later) to all affected systems and validate JWT algorithm enforcement is set to RS256. Within 30 days: Conduct security audit of authentication logs for suspicious Google login activity and reset credentials for any compromised accounts.

Node.js CVE-2026-27804

CRITICAL

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-02-26 security-advisories@github.com

GHSA-4q3h-vp4r-prv2

Node.js Parse Server Parseplatform

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 03:09 nvd

Patch available

CVE Published

Feb 26, 2026 - 00:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

AnalysisAI

Weak cryptographic algorithm in Parse Server before 8.6.3/9.1.1-alpha.4 allows attackers to bypass security mechanisms. Patch available.

Technical ContextAI

CWE-327 use of broken/risky cryptographic algorithm in Parse Server's security implementation.

RemediationAI

Update Parse Server.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all

CVE-2022-3365 CRITICAL POC

9.8

CVE-2014-8687 CRITICAL POC

9.8

CVE-2017-17382 MEDIUM POC

5.9

CVE-2016-6602 CRITICAL POC

9.8

CVE-2023-34039 CRITICAL POC

9.8

CVE-2025-2539 HIGH POC

7.5

CVE-2017-9466 CRITICAL POC

9.8

CVE-2023-5347 CRITICAL POC

9.8

CVE-2026-27804 vulnerability details – vuln.today

Back

Node.js CVE-2026-27804

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

Share

External POC / Exploit Code