2 CVEs
CRITICAL
CVSS 9.8
Parse Server Authentication Flaws
2026-03-12
CVE-2026-32248
CRITICAL
POC
PATCH
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
9.8
CVSS
0.1%
EPSS
CVE-2026-32269
MEDIUM
PATCH
Parse Server's OAuth2 authentication adapter fails to properly validate app IDs when appidField and appIds are configured, allowing attackers to bypass authentication restrictions or cause login failures depending on the introspection endpoint's response handling. Deployments using this specific OAuth2 configuration are vulnerable to authentication bypass if the endpoint accepts malformed requests. A patch is available in versions 9.6.0-alpha.13 and 8.6.39.
6.5
CVSS
0.1%
EPSS