PT-2026-24458 · Unknown · Parse Server

Theinfosecguy · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30967

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.9 Parse Server versions prior to 8.6.22

Description Parse Server, an open-source backend deployable on Node.js infrastructures, contains a flaw in its OAuth2 authentication adapter. When configured without the useridField option, the adapter verifies token activity via the provider’s token introspection endpoint but does not confirm the token’s association with the user identified by authData.id. This allows an attacker possessing any valid OAuth2 token from the same provider to authenticate as any other user. The issue impacts Parse Server deployments utilizing the generic OAuth2 authentication adapter (configured with oauth2: true) without setting the useridField option.

Recommendations Update to Parse Server version 9.5.2-alpha.9 or later. Update to Parse Server version 8.6.22 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-PARSE-2026-30967

CVE-2026-30967

GHSA-FR88-W35C-R596

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30967.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-fr88-w35c-r596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fr88-w35c-r596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30967 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-30967 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30967 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.22 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.9 · Note
• https://twitter.com/CVEnew/status/2031504109035983045 · Twitter Post