Summaryinfo

A vulnerability was found in parse-community parse-server up to 8.6.2/9.1.1-alpha.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Authentication Token Handler. Such manipulation leads to risky encryption. This vulnerability is traded as CVE-2026-27804. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in parse-community parse-server up to 8.6.2/9.1.1-alpha.3 and classified as critical. Affected by this issue is some unknown processing of the component Authentication Token Handler. The manipulation with an unknown input leads to a risky encryption vulnerability. Using CWE to declare the problem leads to CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-27804 since 02/24/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 8.6.3 or 9.3.1-alpha.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-8774). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• parse-community

Name

• parse-server

Version

• 8.6.0
• 8.6.1
• 8.6.2
• 9.1.1-alpha.0
• 9.1.1-alpha.1
• 9.1.1-alpha.2
• 9.1.1-alpha.3

Website

• Product: https://github.com/parse-community/parse-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion