CVE-2026-101042 in Parse Server
Summary
by MITRE • 09/27/2026
Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup and on provider linking, but not when authentication data is supplied together with a username and password on the login endpoint. As a result, a low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account without the provider ever being contacted, spoofing an external identity toward application logic that trusts the linked provider ID. An attacker can also pre-hijack accounts: by claiming the provider ID of a victim who has not yet linked that provider, the victim's later legitimate sign-in with that provider resolves to the attacker's account. Only deployments configuring one of the affected code-based auth adapters are impacted. Versions 9.10.1-alpha.10 and 8.6.91 fix the issue by running the adapter's credential verification on the login and challenge endpoints and rejecting a provider identity already linked to another user. As a workaround, disable the affected code-based auth adapters.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
Parse Server versions ranging from 9.0.0 up to but not including 9.10.1-alpha.10, as well as versions from 8.0.2 up to but not including 8.6.91, contain a critical authentication logic flaw within their code-based authentication adapters. These adapters include support for external identity providers such as GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, and Weibo. The vulnerability stems from an inconsistency in how the server validates authorization codes provided by these third-party services during different phases of user interaction. Specifically, while the system correctly verifies the client's authorization code with the external provider when a new account is created via signup or when an existing account links to a new provider identity, it fails to perform this verification step when authentication data is submitted alongside a username and password on the login endpoint. This omission allows for significant security breaches related to identity spoofing and account takeover.
The operational impact of this flaw is severe because it enables low-privileged authenticated users to attach an arbitrary, unverified provider identity directly to their own accounts without any communication with the external authentication provider. By exploiting this gap in validation logic, an attacker can forge a trusted relationship between their Parse Server user ID and an external identity from one of the supported providers. This effectively allows the attacker to spoof an external identity toward application-level business logic that relies on the integrity of linked provider IDs for authorization decisions or data access controls. The trust model assumes that any account with a specific provider ID has been legitimately verified by that provider, but this vulnerability breaks that assumption entirely during the login flow.
Beyond immediate account manipulation, the flaw facilitates pre-hijacking attacks against victims who have not yet linked their external identity to an existing Parse Server account. An attacker can proactively claim and link a victim's unique provider ID to the attacker's own account before the victim attempts to log in using that same provider. When the legitimate user subsequently initiates a sign-in process with the compromised provider, the system resolves this action to the attacker's pre-existing account rather than creating or accessing the victim's intended profile. This results in an immediate and complete account takeover for the victim, granting the attacker full control over the victim's data and privileges within the application ecosystem without requiring any interaction from the victim other than a standard login attempt.
This vulnerability is categorized under CWE-287, which covers Improper Authentication, specifically relating to the failure to properly verify credentials during specific authentication flows. It also aligns with MITRE ATT&CK techniques such as T1098, Account Manipulation, where adversaries alter account properties or add new accounts to maintain persistence and access. The root cause is a logical error in the server's request handling pipeline that treats login requests differently from signup and linking requests regarding credential validation requirements. This inconsistency creates an exploitable gap that attackers can leverage to bypass standard identity verification protocols inherent to OAuth2 or similar provider-based authentication schemes.
To mitigate this risk, organizations running affected versions of Parse Server must take immediate action if they utilize any of the listed code-based authentication adapters. The recommended remediation is to upgrade to version 9.10.1-alpha.10 or later for the v9 branch, or version 8.6.91 and later for the v8 branch. These patched versions correct the logic by ensuring that credential verification with external providers occurs consistently on both login and challenge endpoints, thereby preventing unverified identities from being linked to user accounts. Additionally, patches include checks to reject provider identity claims if they are already associated with a different user account, effectively neutralizing pre-hijacking attempts. For environments where upgrading is not immediately feasible, the primary workaround is to disable all affected code-based authentication adapters until an upgrade can be performed, thereby removing the attack surface entirely.