CVE Intelligence
Analysis AI-assisted

CVE-2026-27804: Parse Server: account takeover via JWT algorithm confusion in Google auth adapter

Parse Server versions before 8.6.3 and 9.1.1-alpha.4 let an unauthenticated attacker log in as users linked to a Google account, because the Google auth adapter trusted the signing algorithm declared in the token. NVD scores the issue 9.1 (CVSS 3.1) and the GitHub CNA scores it 9.3 (CVSS 4.0). CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Parse Server is an open source Node.js backend. According to the record, versions before 8.6.3 and 9.1.1-alpha.4 accept forged Google authentication tokens because the Google auth adapter trusted the signing algorithm declared in the token header. The weakness is classified as CWE-327, use of a broken or risky cryptographic algorithm.

Impact

  • An unauthenticated remote attacker could log in as users linked to a Google account without knowing their credentials.
  • The advisory data states that all deployments with Google authentication enabled are affected.
  • The NVD CVSS 3.1 vector indicates high confidentiality and integrity impact, with no availability impact.
  • The GitHub CNA scores the issue 9.3 under CVSS 4.0.

Affected products and versions

  • Parse-community Parse-server is listed as versions from 9.0.0 up to but not including 9.3.1-alpha.4, and as versions before 8.6.3.
  • Parseplatform Parse-server is listed as versions before 8.6.3, from 9.0.0 up to but not including 9.3.1, and the pre-releases 9.3.1-alpha1, 9.3.1-alpha2 and 9.3.1-alpha3.
  • The description names 8.6.3 and 9.1.1-alpha.4 as the versions containing the fix. The affected ranges above do not clearly match that description, so the exact boundaries should be confirmed in the vendor advisory.

Exploitation status

  • CISA KEV does not list this vulnerability. The SSVC exploitation value in the record is none, and automatable is yes.
  • No confirmed active exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.00259 and a percentile of 0.16619.

Remediation and mitigation

  • Upgrade to 8.6.3 or 9.1.1-alpha.4, according to the release line in use. Confirm the 9.x boundaries against the vendor advisory and release notes.
  • Until upgrading is possible, disable Google authentication in affected deployments, as the record suggests.
  • Review the authentication configuration of every Parse Server instance to find where Google authentication is enabled.

Detection guidance

  • Review authentication logs for Google adapter logins that do not match expected user behaviour.
  • Look for new sessions opened for accounts linked to Google identities during the exposure window.
  • Maintain an inventory of Parse Server versions and whether Google authentication is enabled in each environment.

Limitations of the available information

  • The affected version ranges in the record conflict with the fixed versions named in the description.
  • The record does not provide the vendor's detection indicators or log signatures.
  • No KEV due date or ransomware usage information is available, because the vulnerability is not listed in KEV.

Frequently asked questions

What is the core problem in CVE-2026-27804?

The Google auth adapter in Parse Server trusted the signing algorithm declared in the token header instead of enforcing the expected algorithm, which allowed forged tokens to be accepted.

Which versions are fixed?

The record's description names 8.6.3 and 9.1.1-alpha.4 as the versions containing the fix. The affected ranges in the record do not clearly match this, so confirm the boundaries in the vendor advisory.

Is this vulnerability being exploited?

CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.