CVE-2026-30967 - Vulnerability Analysis

Overview

Parse Server < 9.5.2-alpha.9 and < 8.6.22 contains an authentication bypass caused by missing useridField verification in OAuth2 adapter, letting attackers authenticate as any user with a valid token, exploit requires OAuth2 token from same provider.

Severity & Score

Impact

Attackers can authenticate as any user with a valid OAuth2 token, leading to unauthorized access.

Mitigation

Upgrade to versions 9.5.2-alpha.9 or 8.6.22 or later.

References

• https://github.com/parse-community/parse-server/releases/tag/8.6.22
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.9
• https://github.com/parse-community/parse-server/security/advisories/GHSA-fr88-w35c-r596

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner