Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-27804

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT hea
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7fc49b82baa45db8004e4a3e6bd5a98940dc38816d7ed40bec90afceaf9ad72d
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-345","description":"CWE-345: Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-327","description":"CWE-327: Use of a Broken or Risky Cryptographic Algorithm","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"parse-server","vendor":"parse-community","versions":[{"status":"affected","version":">= 9.0.0, < 9.3.1-alpha.4"},{"status":"affected","version":"< 8.6.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions
{"cweId":"CWE-345","description":"CWE-345: Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-327","description":"CWE-327: Use of a Broken or Risky Cryptographic Algorithm","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"name":"https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/references/1
{"name":"https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/references/2
{"name":"https://github.com/parse-community/parse-server/releases/tag/8.6.3","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/releases/tag/8.6.3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/references/3
{"name":"https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/references/4
{"name":"https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:15badbb2ed3dd1f76d2ce6464823cb9d56484cb184d5d3b0f809236bdd55b4e9 · sha256:0d38d247d24c8015… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer