CVE-2026-27804: Parse Server Critical Vulnerability in Google Auth Adapter
Summary
CVE-2026-27804: Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter. Affects parse-server across 2 version ranges.
< 8.6.3
>= 9.0.0, < 9.3.1-alpha.4
Fixed in 8.6.3 or 9.3.1-alpha.4, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-27804 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a powerful and flexible server-side infrastructure. It provides features such as user authentication, data storage, and real-time notifications. However, a critical vulnerability has been identified in its Google authentication adapter, which could allow unauthorized access to user accounts.
Vulnerability Detail
The vulnerability arises from a flaw in the Google authentication adapter that allows an unauthenticated attacker to forge a Google authentication token with the algorithm set to 'none'. This means that the attacker can log in as any user linked to a Google account without needing their credentials. The issue is rooted in the adapter's reliance on the JWT header, which can be manipulated, leading to potential account takeovers. All deployments with Google authentication enabled are at risk.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.38.6.3npm install parse-server@8.6.3 -
>= 9.0.0, < 9.3.1-alpha.49.3.1-alpha.4npm install parse-server@9.3.1-alpha.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is advised to disable Google authentication until the package can be upgraded. This can be done by modifying the configuration settings in your Parse Server setup to turn off Google auth.
Conclusion
The vulnerability identified as CVE-2026-27804 in Parse Server's Google authentication adapter poses a significant risk of account takeover. It is crucial for users to update to the patched versions or disable the affected authentication method until they can apply the necessary updates.
See every vulnerability recorded for parse-server →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker could gain unauthorized access to user accounts, leading to data breaches and loss of user trust.
Yes, a permanent fix is available in the updated versions of Parse Server: 9.3.1-alpha.4 and 8.6.3.
If immediate upgrading is not possible, it is recommended to disable Google authentication as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
