What is the CVSS score of CVE-2026-27804?

CVE-2026-27804 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-27804?

This critical vulnerability allows attackers to impersonate any user with Google authentication without credentials, potentially compromising user accounts and sensitive data across all Parse Server…. A patch is available.

How to fix or mitigate CVE-2026-27804?

Within 24 hours: Identify all Parse Server instances with Google authentication enabled and assess exposure. Within 7 days: Apply vendor patches (versions 8.6.3 or 9.1.1-alpha.4 or later) to all affected systems and validate JWT algorithm enforcement is set to RS256. Within 30 days: Conduct security audit of authentication logs for suspicious Google login activity and reset credentials for any compromised accounts.

Node.js CVE-2026-27804

CRITICAL

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-02-26 security-advisories@github.com

GHSA-4q3h-vp4r-prv2

Node.js Parse Server

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 03:09 nvd

Patch available

CVE Published

Feb 26, 2026 - 00:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

AnalysisAI

Weak cryptographic algorithm in Parse Server before 8.6.3/9.1.1-alpha.4 allows attackers to bypass security mechanisms. Patch available.

Technical ContextAI

CWE-327 use of broken/risky cryptographic algorithm in Parse Server's security implementation.

RemediationAI

Update Parse Server.

More in Node.js

View all

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2015-5688 MEDIUM This Month POC

5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2014-7192 CRITICAL Act Now POC

10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

CVE-2013-4450 MEDIUM This Month POC

5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all

CVE-2022-3365 CRITICAL POC

9.8

CVE-2014-8687 CRITICAL POC

9.8

CVE-2017-17382 MEDIUM POC

5.9

CVE-2016-6602 CRITICAL POC

9.8

CVE-2023-34039 CRITICAL POC

9.8

CVE-2025-2539 HIGH POC

7.5

CVE-2017-9466 CRITICAL POC

9.8

CVE-2023-5347 CRITICAL POC

9.8

CVE-2026-27804 vulnerability details – vuln.today

Back

Node.js CVE-2026-27804

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

Share

External POC / Exploit Code