CVE-2026-30967

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

CVSS v4.0

7.6

EPSS

0.33%

Published

Mar 10, 2026

Modified

Mar 11, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspection endpoint, but does not verify that the token belongs to the user identified by authData.id. An attacker with any valid OAuth2 token from the same provider can authenticate as any other user. This affects any Parse Server deployment that uses the generic OAuth2 authentication adapter (configured with oauth2: true) without setting the useridField option. This vulnerability is fixed in 9.5.2-alpha.9. and 8.6.22.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

Affected Products (10)

parseplatform · parse-server (up to 8.6.22)vulnerable

parseplatform · parse-server (up to 9.5.2)vulnerable

parseplatform · parse-servervulnerable

References (3)

https://github.com/parse-community/parse-server/releases/tag/8.6.22

ProductRelease Notes

https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.9

ProductRelease Notes

https://github.com/parse-community/parse-server/security/advisories/GHSA-fr88-w35c-r596

PatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs