PT-2026-23857 · Apple+3 · Authentication Adapter+3

Asukachloe + 1 · Published 2026-03-07 · Updated 2026-03-12 · CVE-2026-30863

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.10 Parse Server versions prior to 9.5.0-alpha.11

Description Parse Server is an open source backend deployable on Node.js infrastructures. The Google, Apple, and Facebook authentication adapters utilize JWT verification to validate identity tokens. When the adapter’s audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification bypasses audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. The issue affects the authentication process when using Google, Apple, and Facebook authentication adapters. The vulnerable component relies on JWT (JSON Web Token) verification for identity validation.

Recommendations Update Parse Server to version 8.6.10 or later. Update Parse Server to version 9.5.0-alpha.11 or later.

Exploit

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

BIT-PARSE-2026-30863

CVE-2026-30863

GHSA-X6FW-778M-WR9V

Affected Products

Authentication Adapter

Facebook Authentication Adapter

Google Authentication Adapter

Parse Server

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30863.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x6fw-778m-wr9v · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30863 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30863 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/TheHackerWire/status/2031418918183776348 · Twitter Post
• https://twitter.com/0dayPublishing/status/2030322299228836225 · Twitter Post
• https://twitter.com/cyberbivash/status/2030377501420109894 · Twitter Post
• https://twitter.com/cracbot/status/2032049054369390645 · Twitter Post
• https://t.me/cveNotify/154935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030378233015816456 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2030290623484264828 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2030209260983103590 · Twitter Post