CVE-2026-27804

CRITICAL EPSS 7.4%
Published Feb 26, 20264mo ago · Modified Jun 17, 20262w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Feb 26, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
7.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-327
CWE-345

Affected Products 5

VendorProductVersionRange
parseplatformparse-server* <8.6.3
parseplatformparse-server*≥9.0.0  –  <9.3.1
parseplatformparse-server9.3.1any
parseplatformparse-server9.3.1any
parseplatformparse-server9.3.1any

References 5

  • github.com https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7
    Patch
  • github.com https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330
    Patch
  • github.com https://github.com/parse-community/parse-server/releases/tag/8.6.3
    Release Notes
  • github.com https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4
    Release Notes
  • github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
    PatchVendor Advisory

Remediation

  • github.com https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7
    Patch
  • github.com https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330
    Patch
  • github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
    PatchVendor Advisory