CVE-2022-24901: Authentication bypass and DoS vulnerabilities in Apple Game Center auth adapter
Summary
CVE-2022-24901: Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter. Affects parse-server across 2 version ranges.
< 4.10.10
>= 5.0.0, < 5.2.1
Fixed in 4.10.10 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2022-24901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apple Game Center authentication adapter is a component of the parse-server package, which is an open-source backend framework for building mobile applications. It provides various features, including user authentication and data storage. The vulnerability in the Apple Game Center auth adapter allows for weak validation of the Apple certificate URL, which can lead to authentication bypass and make the server susceptible to denial of service (DoS) attacks.
Vulnerability Detail
The weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows an attacker to bypass authentication and potentially launch DoS attacks against the server. By exploiting this vulnerability, an attacker can manipulate the URL to trick the server into accepting invalid or malicious certificates, leading to unauthorized access and potential disruption of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.10.104.10.10npm install parse-server@4.10.10 -
>= 5.0.0, < 5.2.15.2.1npm install parse-server@5.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update the parse-server package to the patched version.
Conclusion
The vulnerability in the Apple Game Center auth adapter of the parse-server package allows for authentication bypass and DoS attacks. It is crucial to update the parse-server package to the patched versions mentioned in the 'how_to_fix' section to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows for authentication bypass and makes the server vulnerable to DoS attacks. This can lead to unauthorized access to sensitive data and potential disruption of service.
The vulnerability affects parse-server versions 0.0.0 to 4.10.9 for npm ecosystem and versions 5.0.0 to 5.2.0 for npm ecosystem.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to mitigate the risk.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Advisory Database. The link to the advisory is provided in the 'affected' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.