PT-2026-25072 · Bitnami+4 · Parse+1

Fancymalware · Published 2026-03-12 · Updated 2026-03-16 · CVE-2026-32269

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.13 and 8.6.39

Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by an issue in its OAuth2 authentication adapter. When appidField and appIds are configured, the adapter does not properly validate application IDs. During validation, a malformed value is sent to the token introspection API Endpoint instead of the user’s actual access token. The behavior of the introspection endpoint determines the impact: it could lead to a failure of all OAuth2 logins or allow authentication from unauthorized application contexts if the endpoint returns seemingly valid data for the incorrect request. Deployments utilizing the OAuth2 adapter with appidField and appIds configured are susceptible. The issue involves incorrect parameter alignment in the OAuth2 adapter's app ID validation method.

Recommendations Versions prior to 9.6.0-alpha.13 should be updated to 9.6.0-alpha.13 or later. Versions prior to 8.6.39 should be updated to 8.6.39 or later.

Exploit

Fix

Weakness Enumeration

CWE-683

Related Identifiers

BIT-PARSE-2026-32269

CVE-2026-32269

GHSA-69XG-F649-W5G2

Affected Products

Parse

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32269.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69xg-f649-w5g2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32269 · Security Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.39 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.13 · Note
• https://github.com/parse-community/parse-server · Note
• https://t.me/CVEtracker/47290 · Telegram Post
• https://twitter.com/CVEnew/status/2032230657414303813 · Twitter Post