CVE-2026-101042

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101042
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101042.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101042
Aliases
  • GHSA-mr43-w6c2-mvjq
Published
2026-09-27T16:28:27Z
Modified
2026-09-29T03:30:28Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
Details

Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup and on provider linking, but not when authentication data is supplied together with a username and password on the login endpoint. As a result, a low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account without the provider ever being contacted, spoofing an external identity toward application logic that trusts the linked provider ID. An attacker can also pre-hijack accounts: by claiming the provider ID of a victim who has not yet linked that provider, the victim's later legitimate sign-in with that provider resolves to the attacker's account. Only deployments configuring one of the affected code-based auth adapters are impacted. Versions 9.10.1-alpha.10 and 8.6.91 fix the issue by running the adapter's credential verification on the login and challenge endpoints and rejecting a provider identity already linked to another user. As a workaround, disable the affected code-based auth adapters.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101042.json"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
6d92204b554154eaef395e513da8324984b25ebb
Introduced
f20e0f3ccd6d4256b41f8bd21edf77fda3435d2e
Fixed
2475a26df72f98527e41622d4902bcaa8e5f7c54
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "9.0.0"
        },
        {
            "fixed":  "9.10.1-alpha.10"
        },
        {
            "introduced":  "8.0.2"
        },
        {
            "fixed":  "8.6.91"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

8.*
8.0.2
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.10
8.6.11
8.6.12
8.6.13
8.6.14
8.6.15
8.6.16
8.6.17
8.6.18
8.6.19
8.6.2
8.6.20
8.6.21
8.6.22
8.6.23
8.6.24
8.6.25
8.6.26
8.6.27
8.6.28
8.6.29
8.6.3
8.6.30
8.6.31
8.6.32
8.6.33
8.6.34
8.6.35
8.6.36
8.6.37
8.6.38
8.6.39
8.6.4
8.6.40
8.6.41
8.6.42
8.6.43
8.6.44
8.6.45
8.6.46
8.6.47
8.6.48
8.6.49
8.6.5
8.6.50
8.6.51
8.6.52
8.6.53
8.6.54
8.6.55
8.6.56
8.6.57
8.6.58
8.6.59
8.6.6
8.6.60
8.6.61
8.6.62
8.6.63
8.6.64
8.6.65
8.6.66
8.6.67
8.6.68
8.6.69
8.6.7
8.6.70
8.6.71
8.6.72
8.6.73
8.6.74
8.6.75
8.6.76
8.6.77
8.6.78
8.6.79
8.6.8
8.6.80
8.6.81
8.6.82
8.6.83
8.6.84
8.6.85
8.6.86
8.6.87
8.6.88
8.6.89
8.6.9
8.6.90
9.*
9.0.0
9.1.0
9.1.1
9.10.0
9.10.1-alpha.1
9.10.1-alpha.2
9.10.1-alpha.3
9.10.1-alpha.4
9.10.1-alpha.5
9.10.1-alpha.6
9.10.1-alpha.7
9.10.1-alpha.8
9.10.1-alpha.9
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0
9.5.1
9.6.0
9.6.1
9.7.0
9.8.0
9.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101042.json"