CVE-2026-30967: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30967 is an improper authentication vulnerability in Parse Server's OAuth2 authentication adapter, enabling account takeover via identity spoofing. When the generic OAuth2 adapter is configured with oauth2: true but without the useridField option, it only verifies that a token is active via the provider's token introspection endpoint — it does not verify that the token belongs to the user identified by authData.id. This allows any attacker holding a valid OAuth2 token from the same provider to authenticate as any other user. Affected versions include all Parse Server releases below 8.6.22 and versions 9.0.0 through 9.5.2-alpha.8. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, Parse Server Advisory).

The root cause is classified as CWE-287 (Improper Authentication): the OAuth2 adapter performs token introspection to confirm a token is active but omits the critical step of binding the token's subject identity to the authData.id claimed by the authenticating client. Because useridField was not defaulted to any value, deployments without explicit configuration skipped identity validation entirely. An attacker with a low-privileged, valid OAuth2 token from the same identity provider can craft an authentication request claiming any target user's ID; the server accepts it because the token passes the liveness check. The fix defaults useridField to sub, the standard subject identifier field per RFC 7662, ensuring the token's identity is always validated against the claimed user ID (Parse Server Advisory, GitHub Advisory).

Successful exploitation results in complete account takeover for any user account on the affected Parse Server deployment. An attacker can access, modify, or delete data belonging to any user, including privileged or administrative accounts, leading to high confidentiality and integrity impact. Availability of the vulnerable system itself is not directly impacted, but unauthorized access to administrative accounts could enable further destructive actions. All Parse Server deployments using the generic OAuth2 adapter without useridField configured are affected, regardless of the underlying OAuth2 provider (Parse Server Advisory, GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been confirmed as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.127% (32nd percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to possess a valid OAuth2 token from the same provider configured in the target Parse Server instance, which is a meaningful but achievable precondition (e.g., via a free account with the same provider).

1. Reconnaissance: Identify Parse Server deployments using the generic OAuth2 authentication adapter (oauth2: true) without the useridField option set. This may be inferred from public API documentation, app source code, or error responses.
2. Obtain a valid OAuth2 token: Register or use an existing account with the same OAuth2 provider configured in the target Parse Server. Obtain a valid access token via the provider's standard OAuth2 flow.
3. Identify target user: Determine the authData.id (user identifier) of the victim account on the Parse Server. This may be discoverable via public profiles, API enumeration, or other means.
4. Craft authentication request: Send a login or session creation request to the Parse Server API (e.g., POST /1/users) with the OAuth2 authData block specifying the victim's user ID in authData.id and your own valid access token in authData.access_token.
5. Bypass identity check: The server calls the OAuth2 provider's token introspection endpoint, confirms the token is active, and — without useridField configured — does not verify the token's subject matches the claimed authData.id. Authentication succeeds as the victim user.
6. Account takeover: Use the returned Parse session token to perform any actions as the victim, including reading private data, modifying records, or escalating to administrative functions (Parse Server Advisory, GitHub Advisory).

• Network: Unexpected POST /1/users or session creation requests where the authData.id field does not match the subject (sub) claim of the presented OAuth2 token; multiple authentication requests from a single IP targeting different user IDs in rapid succession.
• Logs: Parse Server access logs showing successful OAuth2 logins for high-value or administrative accounts from unfamiliar IP addresses or at unusual times; authentication events where the OAuth2 token's introspection response subject differs from the authData.id in the request (visible if verbose logging is enabled).
• Application Behavior: Unexpected session tokens issued for privileged accounts; user accounts showing login activity inconsistent with the account owner's normal patterns; data modifications or exports initiated under legitimate user sessions that the user did not perform.

Upgrade Parse Server to version 8.6.22 (for the 8.x branch) or 9.5.2-alpha.9 (for the 9.x alpha branch), both released on March 8, 2026 (Parse Server 8.6.22 Release, Parse Server 9.5.2-alpha.9 Release). If immediate patching is not possible, configure the OAuth2 authentication adapter with the useridField option set to the appropriate field for your provider (e.g., sub per RFC 7662) to ensure token identity is validated against the claimed user ID (Parse Server Advisory). Audit all Parse Server OAuth2 configurations to identify any instances using the generic OAuth2 adapter without useridField explicitly set.

The vulnerability was reported by security researcher theinfosecguy and coordinated by Parse Server maintainer mtrezza, who published the GitHub Security Advisory (GHSA-fr88-w35c-r596) on March 10, 2026 (Parse Server Advisory). A brief write-up was published by Infinit Security covering the account takeover scenario (Infinit Security). No significant broader media coverage or notable social media discussion has been identified beyond standard CVE aggregator postings.