CVE-2026-27804: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27804 is a JWT algorithm confusion vulnerability in Parse Server's Google authentication adapter, enabling unauthenticated attackers to forge Google authentication tokens and log in as any user linked to a Google account without knowing their credentials. It affects all Parse Server versions prior to 8.6.3 (8.x branch) and versions 9.0.0 through 9.3.1-alpha.3 (9.x branch) running on Node.js. The vulnerability was disclosed on February 25, 2026, via GitHub Security Advisory GHSA-4q3h-vp4r-prv2. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is a combination of CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-345 (Insufficient Verification of Data Authenticity): Parse Server's Google auth adapter trusted the alg field from the attacker-controlled JWT header rather than hardcoding the expected RS256 algorithm, and its custom key fetcher did not reject unknown key IDs. An attacker can craft a JWT with alg: "none" and an arbitrary payload (e.g., {"sub":"target_user_id","iss":"accounts.google.com","aud":"<clientId>","exp":9999999999}), omit the signature, and submit it to the Parse Server authentication endpoint. Because alg: none instructs the JWT library to skip signature verification, the server accepts the forged token as valid and authenticates the attacker as the targeted user. The fix commits replace the dynamic algorithm with a hardcoded ['RS256'] and swap the custom key fetcher for jwks-rsa, which rejects unknown key IDs (GitHub Advisory, Patch Commit 8.x, Patch Commit 9.x).

Successful exploitation results in complete account takeover of any user who has linked their account to Google authentication, with no credentials or user interaction required. An attacker can impersonate legitimate users, access their private data stored in Parse Server, modify account settings, and perform any action on their behalf. The confidentiality and integrity of all user data managed by the affected Parse Server instance are at high risk; availability is not directly impacted. Depending on the application's data model, this could enable lateral movement to administrative accounts or exposure of sensitive application data across the entire user base (GitHub Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). However, the attack is trivially executable by any unauthenticated network attacker against any Parse Server deployment with Google authentication enabled, requiring no special tools beyond the ability to craft a JWT. The EPSS score is approximately 0.041%, reflecting low but non-zero exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher sebastianosrt and coordinated by mtrezza (GitHub Advisory).

1. Reconnaissance: Identify Parse Server deployments with Google authentication enabled by probing the /parse/users or authentication endpoints, or by reviewing publicly accessible application configurations.
2. Identify target user: Determine the Google account-linked user ID (sub claim) of the target account — this may be obtainable from public profiles, API responses, or application-level user enumeration.
3. Craft forged JWT header: Base64url-encode a JWT header specifying alg: "none" and an arbitrary or nonexistent kid: {"alg":"none","kid":"nonexistent-key","typ":"JWT"}.
4. Craft forged JWT payload: Base64url-encode a payload with the target user's Google sub, a valid-looking iss (accounts.google.com), the application's aud (client ID), and a far-future exp: {"sub":"<target_user_id>","iss":"accounts.google.com","aud":"<clientId>","exp":9999999999}.
5. Assemble forged token: Concatenate header, payload, and an empty signature: <header>.<payload>. (no signature bytes).
6. Submit to Parse Server: Send a login request to the Parse Server Google auth endpoint (e.g., POST /parse/users) with the forged id_token and the target user's id field.
7. Achieve account takeover: The server accepts the unsigned token, authenticates the attacker as the target user, and returns a valid session token usable for all subsequent API calls (GitHub Advisory, Patch Commit 8.x).

• Network: Unexpected or repeated POST /parse/users (or equivalent auth endpoint) requests containing a JWT with alg: "none" in the decoded header; requests originating from IPs with no prior authentication history for the targeted account.
• Logs: Parse Server access logs showing successful Google authentication events for users from unusual IP addresses or geographic locations; authentication events where the JWT header's alg field is none rather than RS256.
• Application Behavior: Multiple successful logins for the same user account from different, unrelated IP addresses in a short time window; session tokens issued without corresponding legitimate Google OAuth flows; account settings or data modifications immediately following an anomalous login event.

Upgrade Parse Server to version 8.6.3 (8.x branch) or 9.3.1-alpha.4 (9.x branch), which hardcode the expected RS256 algorithm in jwt.verify and replace the custom key fetcher with jwks-rsa to reject unknown key IDs (Release 8.6.3, Release 9.3.1-alpha.4). As an immediate workaround for deployments that cannot upgrade right away, disable Google authentication in the Parse Server configuration until patching is possible (GitHub Advisory). After upgrading, re-enable Google authentication and review recent authentication logs for signs of unauthorized access.

Security Online covered the vulnerability with the headline "Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover," highlighting the severity and ease of exploitation (Security Online). A technical write-up on Dev.to grouped CVE-2026-27804 alongside similar JWT algorithm confusion vulnerabilities (CVE-2026-22817 and CVE-2026-23552), providing a broader fix guide for the class of issue (Dev.to). The vulnerability was also tracked by Red Hat's security advisory system, indicating broad community awareness (Red Hat CVE).