Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

CRITICAL 9.1CVE-2026-27804 · BIT-parse-2026-27804 · GHSA-4q3h-vp4r-prv2 · Published 26/02/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
parse-server parseplatform	`= 9.3.1≥ 9.0.0, < 9.3.1< 8.6.3`	`9.3.18.6.3`
parse-server npm	`≥ 9.0.0, < 9.3.1-alpha.4< 8.6.3`	`9.3.1-alpha.48.6.3`

Description

Impact

An unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected.

Patches

The fix hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs.

Workarounds

Disable Google authentication until you can upgrade.

References

GitHub advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
Fixed in Parse Server 9.3.1-alpha.4: https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4
Fixed in Parse Server 8.6.3: https://github.com/parse-community/parse-server/releases/tag/8.6.3

NVD description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

References

parse-community/parse-server security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-27804 · ADVISORY
parse-community/parse-server commit 9b94083 · WEB
parse-community/parse-server commit 9d5942d · WEB
parse-community/parse-server · PACKAGE
parse-community/parse-server release 8.6.3 · WEB
parse-community/parse-server release 9.3.1-alpha.4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

parse-server

parseplatform

= 9.3.1≥ 9.0.0, < 9.3.1< 8.6.3

9.3.18.6.3

parse-server

npm

≥ 9.0.0, < 9.3.1-alpha.4< 8.6.3

9.3.1-alpha.48.6.3

Description

Impact

Patches

The fix hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs.

Workarounds

Disable Google authentication until you can upgrade.

References

GitHub advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
Fixed in Parse Server 9.3.1-alpha.4: https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4
Fixed in Parse Server 8.6.3: https://github.com/parse-community/parse-server/releases/tag/8.6.3

NVD description