CVE-2026-101042
Received Received - Intake

Authentication Bypass in Parse Server via Provider Spoofing

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup and on provider linking, but not when authentication data is supplied together with a username and password on the login endpoint. As a result, a low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account without the provider ever being contacted, spoofing an external identity toward application logic that trusts the linked provider ID. An attacker can also pre-hijack accounts: by claiming the provider ID of a victim who has not yet linked that provider, the victim's later legitimate sign-in with that provider resolves to the attacker's account. Only deployments configuring one of the affected code-based auth adapters are impacted. Versions 9.10.1-alpha.10 and 8.6.91 fix the issue by running the adapter's credential verification on the login and challenge endpoints and rejecting a provider identity already linked to another user. As a workaround, disable the affected code-based auth adapters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101042
EUVD
EUVD-2026-87968

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
parse parse_server From 8.0.2 (inc) to 8.6.91 (exc)
parse parse_server From 9.0.0 (inc) to 9.10.1-alpha.10 (exc)
parse parse_server 8.6.91
parse parse_server 9.10.1-alpha.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions between 8.0.2-8.6.90 and 9.0.0-9.10.0. It involves code-based authentication adapters (like GitHub, Google Play Games, etc.) that fail to verify provider identities during password-based login. Attackers can attach unverified external identities to their accounts without contacting the provider, enabling identity spoofing or account pre-hijacking.

Detection Guidance

Check if your Parse Server version is within the vulnerable range (8.0.2 to 8.6.90 or 9.0.0 to 9.10.0). Inspect logs for unusual provider identity attachments during login attempts. Review authentication adapter configurations for enabled code-based providers like GitHub or Google.

Impact Analysis

An attacker could impersonate your account by linking an unverified external identity to it. They might also pre-hijack your account by claiming your provider ID before you link it, causing your legitimate login attempts to resolve to their account. This compromises account security and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines authentication controls, potentially causing non-compliance with data protection regulations due to potential data breaches or unauthorized account access.

Mitigation Strategies

Upgrade Parse Server to version 8.6.91 or 9.10.1-alpha.10 or later. If upgrading is not possible, disable the affected code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart