parse-server auth adapter app ID validation can be circumvented
Impact
Validation of the authentication adapter app ID for Facebook and Spotify may be circumvented.
This fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or Spotify and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]). The vulnerability makes it possible to authenticate requests which are coming from a Facebook or Spotify app with a different app ID than the one specified in the appIds configuration.
Both adapters still validate the access token with the respective authentication provider. An app ID is automatically assigned by the authentication provider. For this vulnerability to be exploited, an attacker would have to be assigned an app ID by the authentication provider which is a sub-set of the server-side configured app ID.
The documentation did not explicitly specify that the parameter appIds must be set as an array of strings and setting a string also worked. Therefore, there is a possibility that there are deployments where appIds is set as a string, making them vulnerable.
Patches
The fix makes Parse Server check the type of the value set for appIds and throws an error if the value is not an array.
Workarounds
No known workarounds.
References
- GitHub advisory GHSA-r657-33vp-gp22
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | parse-server | < 4.10.16, >= 5.0.0, < 5.2.7 | 4.10.16, 5.2.7 |
Referencias
- https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22
- https://nvd.nist.gov/vuln/detail/CVE-2022-39231
- https://github.com/parse-community/parse-server/commit/8c8ec715739e0f851338cfed794409ebac66c51b
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/4.10.16
- https://github.com/parse-community/parse-server/releases/tag/5.2.7
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- Debilidad (CWE)
CWE-287- Plataforma
- npm
- Paquete
parse-server- Publicada
- 21.09.2022
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-r657-33vp-gp22 - CC BY 4.0
Historial de vulnerabilidades: parse-server
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 116
- Primera → última
- 06.2019 06.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 17
- Alta 49
- Media 40
- Baja 10
Divulgaciones por año
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
parse-server auth adapter app ID validation can be circumvented esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.