CVE-2026-32269: Parse Server OAuth2 Adapter App ID Validation Flaw
Summary
CVE-2026-32269: Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint. Affects parse across 2 version ranges.
>= 8.0.2, < 8.6.39
>= 9.0.0, < 9.6.0
Fixed in 8.6.39 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-32269 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Parse Server is an open-source backend platform that allows developers to build applications on any infrastructure that supports Node.js. It provides features such as data storage, user authentication, and real-time notifications. The OAuth2 authentication adapter is a critical component that enables secure user authentication via third-party services. However, it has a vulnerability that affects its app ID validation process, potentially compromising the security of applications using this feature.
Vulnerability Detail
The vulnerability arises from the OAuth2 authentication adapter's failure to correctly validate app IDs when the appidField and appIds are configured. Instead of sending the user's actual access token to the token introspection endpoint, a malformed value is sent. This can lead to two scenarios: either all OAuth2 logins fail if the introspection endpoint does not recognize the malformed token, or it may allow unauthorized access if the endpoint returns valid data for the malformed request. This vulnerability affects deployments using the OAuth2 adapter with specific configurations and is present in versions prior to 9.6.0-alpha.13 and 8.6.39.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.2, < 8.6.398.6.39 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling the OAuth2 adapter or modifying your app configuration to avoid using appidField and appIds until the package can be updated to a secure version.
Conclusion
The CVE-2026-32269 vulnerability in the Parse Server OAuth2 adapter poses significant risks to applications using this feature. It is crucial for developers to update to the patched versions to ensure the security of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for parse →
FAQ
CVE-2026-32269 is a vulnerability in the Parse Server OAuth2 adapter that incorrectly validates app IDs, potentially allowing unauthorized access or causing login failures.
Versions prior to 9.6.0-alpha.13 and 8.6.39 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the OAuth2 adapter or adjusting your app configuration to mitigate the risk.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
