Launch Week Day 1: Announcing Security Design Review
UNKNOWN npm

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

GHSA-4q3h-vp4r-prv2 · BIT-parse-2026-27804 · CVE-2026-27804

Published · Modified

Description

Impact

An unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected.

Patches

The fix hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs.

Workarounds

Disable Google authentication until you can upgrade.

References

Ready to move

Start Securing

Free, no credit card | First findings in minutes