NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · npm

CVE-2026-27804: Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

criticalCVSS 4.0 9.3GHSA-4q3h-vp4r-prv2

Impact An unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected.

Published Feb 25, 2026 · Updated Feb 27, 2026

Affected packages

parse-server

Ecosystem
npm
Affected
>= 9.0.0, <= 9.3.1-alpha.3
Fixed in
9.3.1-alpha.4
Check
npm ls parse-server

parse-server

Ecosystem
npm
Affected
<= 8.6.2
Fixed in
8.6.3
Check
npm ls parse-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

An unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected.

Patches

The fix hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs.

Workarounds

Disable Google authentication until you can upgrade.

References

  • GitHub advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2
  • Fixed in Parse Server 9.3.1-alpha.4: https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4
  • Fixed in Parse Server 8.6.3: https://github.com/parse-community/parse-server/releases/tag/8.6.3

Credited to sebastianosrt, mtrezza.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries