Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Impact
The Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server.
- For Google and Apple, the vulnerability is exploitable when the server does not configure
clientId. The adapters accepted this as valid and simply skipped audience validation. - For Facebook Limited Login, the vulnerability exists regardless of configuration. The adapter validated
appIdsonly for Standard Login (Graph API), but the Limited Login JWT path never passedappIdsas the audience to JWT verification.
Patches
The fix enforces clientId (Google/Apple) and appIds (Facebook) as mandatory and passes them to JWT verification for audience validation. While this is technically a breaking change for servers that omit these options, it is not a breaking change as per documentation — all three options are documented as required configuration.
Workarounds
- Google / Apple: Ensure
clientIdis set in the adapter configuration. When set, JWT verification correctly validates the audience claim even on unpatched versions. - Facebook Limited Login: There is no workaround. The unpatched adapter does not pass
appIdsto JWT audience validation, so the only mitigation is to upgrade.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.11
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.10
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | parse-server | >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 | 9.5.0-alpha.11, 8.6.10 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-287- Platform
- npm
- Package
parse-server- Disclosed
- 09.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-x6fw-778m-wr9v - CC BY 4.0
Vulnerability history: parse-server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 116
- First → latest
- 06.2019 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 17
- High 49
- Medium 40
- Low 10
Disclosures per year
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.