PT-2026-25054 · Bitnami+4 · Parse+1

Fancymalware · Published 2026-03-12 · Updated 2026-03-16 · CVE-2026-32242

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.11 and 8.6.37

Description Parse Server, an open source backend deployable on Node.js infrastructures, has an issue where its built-in OAuth2 authentication adapter reuses a singleton instance across all OAuth2 provider configurations. Concurrent authentication requests for different OAuth2 providers can lead to one provider’s token validation using another provider’s configuration. This could allow a token that should be rejected by one provider to be incorrectly accepted due to validation against a different provider’s policy. Deployments configuring multiple OAuth2 providers with the oauth2: true flag are affected. The issue stems from a race condition in the OAuth2 adapter, potentially allowing attackers to bypass token validation.

Recommendations Versions prior to 9.6.0-alpha.11 should be updated to 9.6.0-alpha.11 or later. Versions prior to 8.6.37 should be updated to 8.6.37 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BIT-PARSE-2026-32242

CVE-2026-32242

GHSA-2CJM-2GWV-M892

Affected Products

Parse

Parse Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32242.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2cjm-2gwv-m892 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32242 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32242 · Vendor Advisory
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.37 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/flarestartcom/status/2032383114824012213 · Twitter Post
• https://twitter.com/CVEnew/status/2032230670206992755 · Twitter Post
• https://twitter.com/CCBalert/status/2032475131444937010 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032168248175734933 · Twitter Post
• https://twitter.com/pulsepatchio/status/2033564430123061757 · Twitter Post