Parse Server
CVE-2026-30863
CRITICAL
GHSA-x6fw-778m-wr9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid JWT from different application
-
ExploitSubmit JWT to target Parse Server
-
ExecutionBypass audience validation due to missing clientId/appIds configuration
-
ImpactAuthenticate as arbitrary user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Parse Server with Google, Apple, or Facebook authentication adapter enabled AND audience configuration option not set (clientId for Google/Apple, appIds for Facebook). Requires valid JWT token issued by the identity provider for ANY application. |
| Impact | CVSS 9.8. Parse Server backends store application data including user records, file uploads, and business logic. Widely deployed for mobile app backends. |
| Exploit ScenarioDerived | Attacker bypasses authentication to access Parse Server APIs, reads/modifies application data, creates admin users, or exfiltrates user records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popular open-source backend framework for mobile and web applications.
Earlier versions of this analysis (1)
Authentication bypass in Parse Server backend platform.
RemediationAI
Update Parse Server to the patched version. Audit API access logs.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-287 authentication bypass. The vulnerability allows circumventing authentication mechanisms to access protected API endpoints.
Know when Parse Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.
Executive ViewAI
Parse Server instances using Google, Apple, or Facebook authentication are vulnerable to authentication bypass attacks that could allow unauthorized access to sensitive data and user accounts. This critical vulnerability affects any organization deploying Parse Server without the latest security updates, potentially exposing customer data and compromising system integrity.
Disable Google, Apple, and Facebook authentication adapters until patching is complete; implement Web Application Firewall rules to inspect and validate JWT token structure; restrict Parse Server network access to authorized applications only; enable comprehensive audit logging for all authentication attempts; consider implementing additional identity verification layers or multi-factor authentication; monitor for suspicious authentication patterns and failed token validations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Parse Server Authorization and Authentication Flaws
View all 4More in Parse Server
View allParse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all
Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions.
parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Exploit-DB