VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026

CVE-2026-30863

CVE-2026-30863

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
parse-servernpm
>= 9.0.0-alpha.1, < 9.5.0-alpha.119.5.0-alpha.11
parse-servernpm
< 8.6.108.6.10

Affected products

14
  • Parseplatform/Parse Server11 versions
    cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*+ 10 more
    • cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*range: <8.6.10
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha10:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha8:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha9:*:*:*:node.js:*:*
  • osv-coords2 versions
    pkg:bitnami/parsepkg:npm/parse-server
    < 9.5.0+ 1 more
    • (no CPE)range: < 9.5.0
    • (no CPE)range: >= 9.0.0-alpha.1, < 9.5.0-alpha.11
  • Parse Community/Parse Serverv5
    Range: < 8.6.10

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.