7.4

CVE-2026-32242

Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy. Deployments that configure multiple OAuth2 providers via the oauth2: true flag are affected. This vulnerability is fixed in 9.6.0-alpha.11 and 8.6.37.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.37
Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.6.0
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha1 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha10 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha2 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha3 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha4 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha5 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha6 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha7 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha8 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha9 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.172
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
security-advisories@github.com 9.1 0 0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892
Patch
Vendor Advisory
https://github.com/parse-community/parse-server/releases/tag/8.6.37
Product
Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11
Product
Release Notes