CVE-2026-32269: Parse Server OAuth2 Adapter App ID Validation Flaw
Summary
CVE-2026-32269: Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint. Affects parse-server across 2 version ranges.
>= 8.0.2, < 8.6.39
>= 9.0.0, < 9.6.0-alpha.13
Fixed in 8.6.39 or 9.6.0-alpha.13, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-32269 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and real-time capabilities. The OAuth2 adapter in Parse Server is designed to facilitate secure authentication via OAuth2 protocols. However, a recent vulnerability has been identified that affects the app ID validation process, potentially compromising the security of applications using this feature.
Vulnerability Detail
The vulnerability arises from the OAuth2 authentication adapter's failure to correctly validate app IDs when the 'appidField' and 'appIds' configurations are set. During the validation process, a malformed value is sent to the token introspection endpoint instead of the user's actual access token. This could lead to two scenarios: either all OAuth2 logins may fail if the introspection endpoint does not recognize the malformed token, or it may allow unauthorized access if the endpoint erroneously returns valid data for the malformed request. This flaw poses a significant risk to deployments using the OAuth2 adapter with these configurations.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.0.2, < 8.6.398.6.39npm install parse-server@8.6.39 -
>= 9.0.0, < 9.6.0-alpha.139.6.0-alpha.13npm install parse-server@9.6.0-alpha.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The recommended action is to update to the patched versions as specified.
Conclusion
In summary, CVE-2026-32269 is a significant vulnerability in the Parse Server OAuth2 adapter that can lead to authentication issues or unauthorized access. It is crucial for developers using this framework to update to the patched versions to ensure the security of their applications.
See every vulnerability recorded for parse-server →
FAQ
CVE-2026-32269 is a vulnerability in the Parse Server OAuth2 adapter that affects app ID validation, potentially leading to unauthorized access or login failures.
If your application uses the OAuth2 adapter with 'appidField' and 'appIds' configured, it may either fail to authenticate users or allow unauthorized access.
You should update your Parse Server package to the latest patched version to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
